CVE-2026-60561
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. While the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle WebCenter Portal component known as Runtime Tools within the broader Oracle Fusion Middleware ecosystem. The affected versions span 12.2.1.4.0 and 14.1.2.0.0, representing critical security gaps that enable attackers to gain unauthorized control over portal environments. The vulnerability demonstrates a high degree of exploitability requiring only network access through HTTP protocols with minimal privileges needed for successful exploitation.
The technical flaw manifests as an insufficient authorization mechanism within the Runtime Tools component that fails to properly validate user permissions during runtime operations. This weakness allows authenticated users with low privilege levels to perform administrative actions typically restricted to authorized personnel. The vulnerability's classification aligns with CWE-285, which addresses improper authorization in software systems, specifically targeting runtime tool access controls that should enforce strict permission boundaries.
Operational impact assessment reveals severe consequences for organizations utilizing affected Oracle WebCenter Portal versions. Successful exploitation can result in complete system compromise, enabling attackers to execute arbitrary code, modify portal content, access sensitive data, and potentially establish persistent backdoors within the environment. The CVSS 3.1 base score of 9.9 reflects the critical nature of this vulnerability with high impacts across confidentiality, integrity, and availability domains. The scope change aspect indicates that exploitation may affect additional Oracle products within the same ecosystem, amplifying potential damage beyond the primary target.
The attack vector through HTTP network access makes this vulnerability particularly dangerous as it requires minimal prerequisites for exploitation while potentially affecting critical business applications. Attackers leveraging this weakness can achieve complete system takeover, which aligns with ATT&CK technique T1078 for valid accounts and T1566 for social engineering via HTTP protocols. Organizations should prioritize immediate remediation through Oracle security patches or temporary network segmentation to prevent unauthorized access attempts.
Mitigation strategies include applying the latest Oracle Critical Patch Updates (CPU) addressing this specific vulnerability, implementing network-based controls such as firewalls restricting HTTP access to administrative interfaces, and conducting thorough privilege reviews to minimize potential attack surfaces. Additionally, organizations should enhance monitoring capabilities for unusual authentication patterns and implement proper access control policies to prevent unauthorized administrative operations within their WebCenter Portal deployments.