What is the CVSS score of CVE-2026-60566?

CVE-2026-60566 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Portal are affected by CVE-2026-60566?

Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical vulnerability permitting complete system compromise via internet-accessible HTTP requests without requiring…

How to fix or mitigate CVE-2026-60566?

Within 24 hours: Identify all Oracle WebCenter Portal instances running versions 12.2.1.4.0 or 14.1.2.0.0 in production and development environments, then implement network access controls or Web Application Firewall rules restricting HTTP access to the Runtime Tools component to authorized administrators only. Within 7 days: Monitor Oracle security advisories for patch availability and develop an emergency remediation plan including upgrade procedures, testing protocols, and rollback procedures; meanwhile, establish continuous monitoring for exploitation attempts on affected systems. Within 30 days: Execute your remediation plan when patches become available-through version upgrades or system decommissioning if operationally feasible-while maintaining compensating controls until full patching is complete.

Oracle WebCenter Portal CVE-2026-60566

EUVD-2026-46928 CRITICAL

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-rrhq-g4jc-j676

Oracle Webcenter Portal Privilege Escalation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle describes easily exploitable unauthenticated HTTP attack yielding full takeover, so AV:N/AC:L/PR:N/UI:N with complete C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:35 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full product takeover of Oracle WebCenter Portal (versions 12.2.1.4.0 and 14.1.2.0.0) is possible by a remote, unauthenticated attacker over HTTP against the Runtime Tools component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, base 9.8) reflects that no credentials, user interaction, or special conditions are needed, and a successful attack fully compromises confidentiality, integrity, and availability. This is a July 2026 Oracle Critical Patch Update item with no public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

Oracle WebCenter Portal is an enterprise Java/Fusion Middleware platform (built on WebLogic Server) for building portals, intranets, and composite web applications. The affected component is 'Runtime Tools', an internal administrative/runtime interface within the portal; flaws in this class of Fusion Middleware component historically stem from deserialization, authentication-bypass, or SSRF/request-handling weaknesses exposed over HTTP. Oracle does not assign a CWE for this CVE (CWE: N/A) and, per its CPU disclosure practice, publishes no root-cause detail, so the exact weakness class cannot be confirmed from available data. Oracle's own tag of 'Information Disclosure' understates the CVSS profile, which indicates full integrity and availability impact (takeover), not merely disclosure.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, which contains the fix for the Runtime Tools component; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch/bundle numbers applicable to your 12.2.1.4.0 or 14.1.2.0.0 deployment (Patch available per vendor advisory; Oracle publishes patch identifiers per product in the CPU matrix rather than a single semantic version). Because exploitation is unauthenticated over HTTP, until patching is complete restrict network exposure of the portal - place it behind a VPN or IP allowlist, block direct internet access to the WebCenter Portal HTTP endpoints, and if feasible restrict or disable access to the Runtime Tools administrative paths via WebLogic/reverse-proxy URL filtering (trade-off: may disrupt legitimate administrative and runtime configuration workflows). Add WAF rules and monitor access logs for anomalous requests to portal admin/runtime endpoints as a detective control. These are compensating measures only; the CPU patch is the sole confirmed remediation.