CVE-2026-60556 in WebCenter Sites
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. While the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle WebCenter Sites, a component of Oracle Fusion Middleware that serves as a web content management platform. The affected versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical security flaw that enables unauthenticated attackers to gain unauthorized access through HTTP network connections. The vulnerability's ease of exploitation makes it particularly dangerous as it requires no authentication credentials or specialized privileges from the attacker. The CVSS 3.1 base score of 8.6 indicates a high severity threat with significant confidentiality impact, reflecting the potential for unauthorized access to sensitive data and complete system compromise.
The technical nature of this vulnerability stems from insufficient input validation and access control mechanisms within the WebCenter Sites component. Attackers can exploit this weakness by sending specially crafted HTTP requests that bypass normal authentication procedures, allowing them to directly access the underlying content management system. This flaw operates at the application layer and leverages the inherent trust placed in HTTP communication channels. The vulnerability's scope change aspect indicates that successful exploitation could potentially impact additional Oracle products within the same ecosystem, creating cascading security risks across interconnected systems.
The operational impact of this vulnerability is severe as it can result in unauthorized access to critical data including sensitive content, user information, and system configurations. An attacker who successfully exploits this vulnerability gains complete access to all data that the WebCenter Sites application can reach, potentially compromising entire content repositories and associated databases. The confidentiality impact rating of high means that attackers could extract valuable intellectual property, personal information, or business-critical data without detection. Organizations relying on Oracle WebCenter Sites for content management, digital asset storage, or web publishing operations face significant risk of data breaches and regulatory compliance violations.
Security professionals should implement immediate mitigations including network-level access controls through firewalls to restrict HTTP access to trusted networks only. Applying the latest Oracle security patches and updates is essential to resolve this vulnerability at the source. Organizations must also conduct comprehensive network segmentation to limit lateral movement if exploitation occurs, implementing principle of least privilege access controls for WebCenter Sites components. Monitoring network traffic for suspicious HTTP requests and establishing intrusion detection systems can help identify potential exploitation attempts. This vulnerability aligns with CWE-287 (Improper Authentication) and maps to ATT&CK technique T1190 (Exploit Public-Facing Application) in the adversary behavior framework, emphasizing the need for robust application security controls and regular vulnerability assessments.