CVE-2026-60558 in WebCenter Sites
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle WebCenter Sites, a component of Oracle Fusion Middleware that serves as a web content management platform for enterprise organizations. The affected versions 12.2.1.4.0 and 14.1.2.0.0 represent critical security gaps in the application's authentication mechanisms. The vulnerability's classification as difficult to exploit indicates that while sophisticated attackers can potentially leverage it, the attack vector requires specific conditions to be met. The CVSS score of 8.1 places this vulnerability in the high severity category, reflecting the substantial impact across confidentiality, integrity, and availability domains.
The technical flaw manifests through insufficient authentication controls within the HTTP communication layer of WebCenter Sites. This allows an unauthenticated attacker positioned on the network to potentially gain complete control over the affected system. The attack requires network access via HTTP protocols, making it accessible to remote threat actors without requiring prior authorization or credentials. The vulnerability's nature suggests improper input validation or session management flaws that permit unauthorized access to administrative functions or sensitive system components.
The operational impact of successful exploitation encompasses full system compromise with potential data breaches, service disruption, and unauthorized modifications to content management systems. Organizations relying on WebCenter Sites for critical business operations face significant risks including exposure of confidential information, manipulation of web content, and potential use as a foothold for further lateral movement within network environments. The availability impact could result in complete service outage, while integrity compromise may lead to injection of malicious content or alteration of legitimate data.
Security mitigations should focus on immediate patch application for the affected versions, network segmentation to limit access to WebCenter Sites components, and implementation of robust web application firewalls. Organizations must conduct thorough vulnerability assessments to identify any exploitation attempts and establish monitoring protocols for unusual HTTP traffic patterns. The vulnerability aligns with CWE-287, which addresses improper authentication issues, and maps to ATT&CK technique T1190 for exploitation through web applications. Regular security audits of Oracle Fusion Middleware installations are essential to maintain defensive posture against similar vulnerabilities in the broader Oracle ecosystem.