CVE-2026-60561
Undergoing Analysis Undergoing Analysis - In Progress

Oracle WebCenter Portal Remote Code Execution

Publication date: 2026-07-21

Last updated on: 2026-08-01

Assigner: Oracle

Description
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. While the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-08-01
Generated
2026-08-11
AI Q&A
2026-07-22
EPSS Evaluated
2026-08-09
NVD
CVE-2026-60561
EUVD
EUVD-2026-46923

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
oracle webcenter_portal 12.2.1.4.0
oracle webcenter_portal 14.1.2.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low-privileged attacker with network access to take over the entire Oracle WebCenter Portal system. The vulnerability has a CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability.

Detection Guidance

Detection requires checking for Oracle WebCenter Portal versions 12.2.1.4.0 or 14.1.2.0.0. Verify installed versions via Oracle Fusion Middleware documentation or server logs. Monitor network traffic for unusual HTTP requests targeting Oracle WebCenter Portal components.

Impact Analysis

An attacker could exploit this to gain full control of your Oracle WebCenter Portal, potentially accessing sensitive data, modifying system configurations, or disrupting services. The attack requires only network access and low privileges, making it relatively easy to exploit.

Compliance Impact

This vulnerability allows attackers to take over Oracle WebCenter Portal, which could lead to unauthorized access to sensitive data. This may violate compliance requirements under GDPR (data protection) and HIPAA (health information security) due to potential confidentiality and integrity breaches.

Mitigation Strategies

Apply the latest security patches from Oracle for Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0. Restrict network access to HTTP ports used by Oracle WebCenter Portal. Monitor for unusual activity in Oracle WebCenter Portal logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-60561. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart