What is the CVSS score of CVE-2026-60565?

CVE-2026-60565 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Portal are affected by CVE-2026-60565?

Oracle WebCenter Portal (Fusion Middleware) contains a CRITICAL vulnerability (CVSS 9.9) permitting full takeover by a low-privilege attacker with network access, with cascading impact to connected…

How to fix or mitigate CVE-2026-60565?

Within 24 hours: immediately restrict all network access to Oracle WebCenter Portal instances to essential authorized users only, isolate instances from production networks where feasible, and enable comprehensive audit logging of all authentication and administrative activities. Within 7 days: conduct complete inventory of WebCenter Portal deployments and systems dependent on them, implement network segmentation to separate affected instances from critical infrastructure and data assets, and confirm access restriction controls are functioning. Within 30 days: maintain regular communication with Oracle for patch availability information, evaluate alternatives or accelerated decommissioning plans, and deploy intrusion detection systems to monitor for exploitation attempts.

Oracle WebCenter Portal CVE-2026-60565

EUVD-2026-46927 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-8cf6-x7p8-75mw

Oracle Webcenter Portal Authentication Bypass

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network HTTP vector with low complexity and a required low-privilege account (PR:L) per Oracle; scope change (S:C) and full C/I/A takeover justify the 9.9.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:36 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. While the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle WebCenter Portal (Fusion Middleware, Runtime Tools component) is achievable by a low-privileged attacker with network access over HTTP, per Oracle's July 2026 Critical Patch Update. Because the flaw carries a scope change (S:C), successful exploitation can significantly impact additional products beyond WebCenter Portal itself, driving the CVSS 3.1 base score to 9.9. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Oracle WebCenter Portal is a Java/Oracle Fusion Middleware application built on WebLogic Server that provides enterprise portal, collaboration, and content presentation services. The vulnerable component is Runtime Tools, and the CWE is not assigned in the source data, so the precise root-cause class cannot be confirmed; the low attack complexity, low-privilege requirement, and scope change are consistent with an authenticated request that crosses a trust boundary (e.g., an authorization or injection weakness in a runtime administrative/tooling endpoint) into the underlying WebLogic container. Oracle's advisory notes only the affected versions (12.2.1.4.0 and 14.1.2.0.0) and does not publish CPE strings in the provided data, so exact build/patch-level enumeration should be confirmed against the Oracle CPU. The scope change (S:C) indicates the vulnerable component and the impacted component differ, which for Fusion Middleware typically means compromise reaches co-located WebLogic or integrated products.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor-released patch vehicle for both affected versions (12.2.1.4.0 and 14.1.2.0.0); Oracle does not publish a discrete fix build number in the provided data, so identify the exact patch/bundle for your version from the CPU matrix. Oracle explicitly states these vulnerabilities are remotely exploitable without a patch and recommends applying CPU fixes without delay. As compensating controls until patching, restrict network reachability of the WebCenter Portal HTTP endpoints to trusted management networks or via VPN, disable or block access to Runtime Tools administrative endpoints for users who do not need them, and tighten account provisioning to remove self-registration and prune unnecessary low-privilege accounts (since PR:L means any valid low-privilege user can exploit this) - noting that restricting endpoints and registration may disrupt legitimate portal self-service and collaboration workflows. Monitor portal and WebLogic logs for anomalous authenticated requests to Runtime Tools.