What is the CVSS score of CVE-2026-60566?

CVE-2026-60566 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2026-60566?

Within 24 hours: Identify all Oracle WebCenter Portal instances running versions 12.2.1.4.0 or 14.1.2.0.0 in production and development environments, then implement network access controls or Web Application Firewall rules restricting HTTP access to the Runtime Tools component to authorized administrators only. Within 7 days: Monitor Oracle security advisories for patch availability and develop an emergency remediation plan including upgrade procedures, testing protocols, and rollback procedures; meanwhile, establish continuous monitoring for exploitation attempts on affected systems. Within 30 days: Execute your remediation plan when patches become available-through version upgrades or system decommissioning if operationally feasible-while maintaining compensating controls until full patching is complete.

Oracle WebCenter Portal CVE-2026-60566

EUVD-2026-46928 CRITICAL

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-rrhq-g4jc-j676

Privilege Escalation Oracle Webcenter Portal

9.8

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach exposed WebCenter Portal HTTP endpoint
Delivery

Send crafted request to Runtime Tools
Exploit

Trigger unauthenticated flaw
Execution

Gain control of portal
Impact

Full product takeover (data theft, tampering, disruption)

Vulnerability Assessment

Weakness	CWE CWE-269 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V8 - Authorization Least privilege enforcement MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions - remote unauthenticated exploitation over HTTP against supported deployments of Oracle WebCenter Portal (12.2.1.4.0 and 14.1.2.0.0), consistent with AV:N/AC:L/PR:N/UI:N. The practical limiting factor is network reachability of the vulnerable Runtime Tools component: exploitation requires the attacker to reach the portal's HTTP interface, so deployments where WebCenter Portal is not internet-exposed (behind VPN, firewall, or reverse-proxy access controls) materially reduce real-world exposure. No authentication, no user interaction, and no non-default configuration are required per the CVSS vector.
Impact	All available severity signals align toward high priority: CVSS 9.8 with a fully remote, low-complexity, unauthenticated, no-interaction vector (AV:N/AC:L/PR:N/UI:N) and complete C/I/A impact, described by Oracle as 'easily exploitable' resulting in product 'takeover'. Countervailing signals lower immediate urgency: no EPSS score was provided, the CVE is not in CISA KEV (no confirmed active exploitation), and no public exploit code was identified at time of analysis, so this is a critical-severity but not-yet-weaponized issue. One inconsistency to note: Oracle's tag 'Information Disclosure' conflicts with the full I:H/A:H takeover impact in the CVSS vector - treat the CVSS vector and 'takeover' language as authoritative and the tag as a partial/miscategorized label. Given Oracle Fusion Middleware's history of rapid exploitation after CPU disclosure, this should be patched on an emergency basis despite the current absence of a public PoC.
Exploit ScenarioDerived	An attacker on the network sends a crafted HTTP request directly to an internet-exposed WebCenter Portal Runtime Tools endpoint, requiring no credentials or user interaction. The single request triggers the flaw and yields full control of the portal, allowing data theft, content tampering, and disruption of the service. No public exploit code was identified at time of analysis, but the low attack complexity makes rapid PoC development likely after CPU disclosure.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 22, 2026

Full product takeover of Oracle WebCenter Portal (versions 12.2.1.4.0 and 14.1.2.0.0) is possible by a remote, unauthenticated attacker over HTTP against the Runtime Tools component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, base 9.8) reflects that no credentials, user interaction, or special conditions are needed, and a successful attack fully compromises confidentiality, integrity, and availability. This is a July 2026 Oracle Critical Patch Update item with no public exploit identified at time of analysis and no CISA KEV listing.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, which contains the fix for the Runtime Tools component; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch/bundle numbers applicable to your 12.2.1.4.0 or 14.1.2.0.0 deployment (Patch available per vendor advisory; Oracle publishes patch identifiers per product in the CPU matrix rather than a single semantic version). Because exploitation is unauthenticated over HTTP, until patching is complete restrict network exposure of the portal - place it behind a VPN or IP allowlist, block direct internet access to the WebCenter Portal HTTP endpoints, and if feasible restrict or disable access to the Runtime Tools administrative paths via WebLogic/reverse-proxy URL filtering (trade-off: may disrupt legitimate administrative and runtime configuration workflows). Add WAF rules and monitor access logs for anomalous requests to portal admin/runtime endpoints as a detective control. These are compensating measures only; the CPU patch is the sole confirmed remediation.

Affected VersionsENISA

Oracle WebCenter Portal 12.2.1.4.0

Oracle WebCenter Portal 14.1.2.0.0

Affected Packages

euvd oracle_webcenter_portal no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Oracle WebCenter Portal is an enterprise Java/Fusion Middleware platform (built on WebLogic Server) for building portals, intranets, and composite web applications. The affected component is 'Runtime Tools', an internal administrative/runtime interface within the portal; flaws in this class of Fusion Middleware component historically stem from deserialization, authentication-bypass, or SSRF/request-handling weaknesses exposed over HTTP. Oracle does not assign a CWE for this CVE (CWE: N/A) and, per its CPU disclosure practice, publishes no root-cause detail, so the exact weakness class cannot be confirmed from available data. Oracle's own tag of 'Information Disclosure' understates the CVSS profile, which indicates full integrity and availability impact (takeover), not merely disclosure.

Know when Webcenter Portal gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 9.8 CRITICAL

Oracle describes easily exploitable unauthenticated HTTP attack yielding full takeover, so AV:N/AC:L/PR:N/UI:N with complete C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Executive ViewAI

Why It Matters

Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical vulnerability permitting complete system compromise via internet-accessible HTTP requests without requiring authentication or user credentials. Organizations running these versions face immediate risk of data theft, unauthorized content manipulation, and platform unavailability from a single network attack. Emergency action is required to assess deployment scope and implement containment measures pending patch availability.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement network-level access controls or WAF rules to restrict Runtime Tools HTTP component access to authorized administrators only; (2) Enable detailed request logging and alerting on Runtime Tools endpoints to detect exploitation attempts; (3) Isolate affected systems to restricted networks with monitored ingress/egress; (4) Establish dedicated monitoring for exploitation signatures and anomalous behavior patterns. These controls substantially reduce attack surface but do not eliminate risk; they are temporary measures pending patch deployment.

Threat Intelligence Overview

EPSS Score

0.4%

Top 72% exploitable

Prevalence

Medium

enterprise Fusion Middleware portal, common in large orgs but not ubiquitous

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Out-of-Cycle

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

Very High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.