What is the CVSS score of CVE-2026-60564?

CVE-2026-60564 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Portal are affected by CVE-2026-60564?

A critical authorization bypass vulnerability in Oracle WebCenter Portal (CVSS 9.6) allows authenticated users to circumvent access controls and read or modify sensitive business data across affected…

How to fix or mitigate CVE-2026-60564?

Within 24 hours, inventory all Oracle WebCenter Portal instances running versions 12.2.1.4.0 or 14.1.2.0.0 and classify by business criticality and data sensitivity. Within 7 days, restrict authenticated network access to affected portals to essential users and systems only via network segmentation, enable detailed audit logging for all portal data access and modification events with real-time alerting, and conduct immediate user privilege reviews to enforce least-privilege principles. Within 30 days, monitor Oracle's Critical Patch Update notifications for vendor-released patches, establish a staging environment to validate patches before production deployment, and evaluate interim technical controls such as Web Application Firewall (WAF) rules or API-level authorization restrictions to further restrict unauthorized access until patches are available.

Oracle WebCenter Portal CVE-2026-60564

EUVD-2026-46926 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-vvjp-hcw7-h4x2

Authentication Bypass Oracle Webcenter Portal

9.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

9.6 CRITICAL

Network HTTP reach with low complexity and a required low-privilege account give AV:N/AC:L/PR:L; authority bypass yields S:C with high C/I and no availability impact (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:37 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.6

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. While the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Portal accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Portal accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).

AnalysisAI

Privilege/authorization bypass in Oracle WebCenter Portal (Fusion Middleware, Runtime Tools component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, authenticated network attacker read and modify all portal-accessible data over HTTP. The scope-changing flaw (CVSS 3.1 base 9.6) can significantly impact additional products beyond the portal itself and is tagged as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV; disclosed via the Oracle Critical Patch Update of July 2026.

Technical ContextAI

Oracle WebCenter Portal is a Java-based Oracle Fusion Middleware platform (running on WebLogic Server) for enterprise portals, self-service intranets, and composite content-driven applications. The defect resides in the Runtime Tools component and is reachable over HTTP. Oracle assigns no CWE, but the 'Authentication Bypass' tag combined with the CVSS scope change (S:C) indicates the actor can operate beyond the security authority that granted their initial low-privilege session, crossing into resources governed by a different trust boundary such as the underlying WebLogic domain or federated Fusion Middleware components. Oracle's terse CPU wording does not disclose the exact mechanism, so the precise root-cause class is not independently confirmed.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 for WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 (patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships these through the CPU patch bundle rather than a re-versioned build, so a specific fixed build string is not independently confirmed from the input data. Because exploitation requires a low-privileged authenticated session, compensating controls until patching completes include restricting network reachability of the WebCenter Portal and Runtime Tools endpoints to trusted management networks or VPN, tightening account provisioning to remove unnecessary low-privilege portal accounts, and placing a WAF/reverse proxy in front of the portal to monitor and rate-limit anomalous HTTP requests to Runtime Tools paths. Trade-offs: network restriction may break legitimate remote or federated portal access, and aggressive WAF rules on Runtime Tools may interfere with administrative tooling - validate in staging. Given the scope-change impact, also review the WebLogic domain and adjacent Fusion Middleware trust boundaries.