What is the CVSS score of CVE-2026-60568?

CVE-2026-60568 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebCenter Portal are affected by CVE-2026-60568?

Critical vulnerability in Oracle WebCenter Portal Fusion Middleware (CVE-2026-60568, CVSS 9.9) enables complete system compromise for low-privileged attackers with network access, with cascading…

How to fix or mitigate CVE-2026-60568?

Within 24 hours: Conduct immediate inventory of all WebCenter Portal instances running versions 12.2.1.4.0 or 14.1.2.0.0, restrict network access to administrative and essential functions only, and enable detailed audit logging. Within 7 days: Implement network segmentation isolating affected portals from other systems, deploy Web Application Firewall rules to filter exploitation patterns, and establish dedicated security monitoring for anomalous authentication and portal activity. Within 30 days: Contact Oracle Support to confirm patch timeline; if no patch is forthcoming within 30 days, develop and execute migration plan to patched major version or implement air-gapping of non-critical instances as interim measure.

Oracle WebCenter Portal CVE-2026-60568

EUVD-2026-46930 CRITICAL

Improper Authentication (CWE-287)

2026-07-21 secalert_us@oracle.com

GHSA-89j9-c82h-p8p2

Oracle Webcenter Portal Authentication Bypass

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network HTTP reachable with low complexity, requires a low-privileged account (PR:L), no user interaction, and a scope change to adjacent middleware yields full C/I/A takeover.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:34 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. While the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle WebCenter Portal (Fusion Middleware, Runtime Tools component) affects versions 12.2.1.4.0 and 14.1.2.0.0, where a low-privileged attacker with HTTP network access can take over the portal and, because of a scope change, significantly impact other products. Oracle rates this CVSS 3.1 9.9 (Critical) with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and minimal privilege requirement make it a high-priority patch item.

Technical ContextAI

Oracle WebCenter Portal is a Java/Weblogic-based enterprise portal framework within Oracle Fusion Middleware used to build intranets, extranets, and composite web applications. The flaw resides in the Runtime Tools component and is reachable over HTTP. Oracle marks the CWE as N/A, but the Oracle-supplied tag 'Information Disclosure' combined with a full C/I/A impact and a scope change (S:C) is consistent with an authenticated-but-low-privilege user escaping the WebCenter security boundary to act on the underlying WebLogic/middleware layer. Because WebCenter Portal typically runs on WebLogic Server and integrates with content, identity, and other Fusion Middleware services, a scope-changing compromise can propagate to those adjacent components.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 - patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html - for both affected releases, 12.2.1.4.0 and 14.1.2.0.0; no standalone fixed build number was provided in the input, so obtain the exact CPU patch bundle for your version from My Oracle Support. Until patched, reduce exposure by restricting network access to the WebCenter Portal HTTP endpoints (place them behind a VPN or IP allowlist and block untrusted internet reachability), disabling self-service account registration so an attacker cannot trivially obtain the low-privilege account the exploit requires, and tightening WebCenter Runtime Tools access to trusted administrators - trade-offs are reduced convenience for remote users and loss of self-registration functionality. Increase monitoring/WAF inspection of portal HTTP traffic as a detective control, recognizing it does not fully block a scope-changing takeover.