What is the CVSS score of CVE-2026-60563?

CVE-2026-60563 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebCenter Portal are affected by CVE-2026-60563?

Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 (Runtime Tools component) contain a critical vulnerability enabling any authenticated user with minimal portal credentials to escalate to…

How to fix or mitigate CVE-2026-60563?

Within 24 hours: inventory all systems running WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 and assess current user populations with portal access. Within 7 days: implement network-level restrictions to limit Runtime Tools component exposure, enforce multi-factor authentication for portal access, and deploy enhanced monitoring for privilege escalation attempts. Within 30 days: contact Oracle for patch timeline and workaround options; if patches remain unavailable, evaluate disabling the Runtime Tools component if operationally feasible or restricting its use to isolated administrative accounts only.

Oracle WebCenter Portal CVE-2026-60563

EUVD-2026-46925 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-jxgv-39p5-62cp

Authentication Bypass Oracle Webcenter Portal

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reachable and low-complexity, but requires a valid low-privilege portal account so PR:L; full takeover justifies C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:37 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full account/system takeover in Oracle WebCenter Portal (versions 12.2.1.4.0 and 14.1.2.0.0, Runtime Tools component) allows an authenticated low-privileged attacker to compromise the product over HTTP and gain complete control. Oracle rates this 'easily exploitable' with CVSS 8.8 (C:H/I:H/A:H), meaning any user with minimal portal credentials can escalate to full compromise. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and Oracle's own 'easily exploitable' characterization make it a high-priority patch.

Technical ContextAI

Oracle WebCenter Portal is an enterprise Java/Fusion Middleware platform (running on Oracle WebLogic Server) for building intranet/extranet portals, collaboration spaces, and content-driven web applications. The flaw resides in the Runtime Tools component, which handles runtime administration and portal management functions exposed over HTTP. Oracle does not disclose a CWE for this issue and the description is deliberately vague (a standard practice in Oracle Critical Patch Update advisories), so the exact root-cause class - likely an access-control or injection weakness in a runtime endpoint - cannot be confirmed from the available data. The CVSS scope is Unchanged (S:U), indicating the compromise stays within the WebCenter Portal security authority rather than pivoting to the underlying OS or WebLogic domain.

RemediationAI

Apply the Oracle Critical Patch Update fixes released in the July 2026 CPU (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor's patch mechanism for both affected releases (12.2.1.4.0 and 14.1.2.0.0); Patch available per vendor advisory, though a discrete fixed build number is not stated in the provided data - consult the CPU patch matrix for the exact bundle/interim patch for your version. As compensating controls until patching, restrict network access to the WebCenter Portal Runtime Tools and administrative endpoints to trusted management networks (front them behind a WAF or reverse proxy and block direct external HTTP access), tighten role assignments so low-privilege portal accounts cannot reach runtime administration functions, and monitor portal logs for anomalous requests to runtime/admin URLs; the trade-off is that URL-based blocking may disrupt legitimate portal administration and must be validated against your deployment. Because exploitation only requires low privileges, also review and prune unnecessary portal user accounts and enforce strong credential hygiene to shrink the pool of accounts that could be abused.