CVE-2026-60728 in WebCenter Portal
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Portal accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Portlet Services component of Oracle WebCenter Portal, a key element of the Oracle Fusion Middleware suite affecting versions 12.2.1.4.0 and 14.1.2.0.0. This security flaw is characterized by its high severity, with a CVSS 3.1 Base Score of 9.1, indicating critical risk to system integrity and availability. The vulnerability allows for exploitation by an unauthenticated attacker who requires only network access via the HTTP protocol. Unlike vulnerabilities that require user interaction or valid credentials, this flaw can be triggered remotely without any prior authentication, significantly lowering the barrier to entry for malicious actors seeking to compromise the target environment.
From a technical perspective, the core issue lies in how Portlet Services handles incoming requests over HTTP. The lack of proper input validation or access control mechanisms enables an attacker to send specially crafted HTTP requests that exploit internal logic errors within the portal infrastructure. This exploitation path does not necessitate any user interface interaction, meaning automated tools can be used to probe and attack the system efficiently. The absence of authentication requirements means that even users with no legitimate account on the Oracle WebCenter Portal instance are capable of initiating attacks against the service endpoints exposed through Portlet Services.
The operational impact of this vulnerability is severe due to its dual effect on confidentiality and availability, as reflected in the CVSS vector components for High Confidentiality and High Availability impacts while Integrity remains Unchanged. Successful exploitation can lead to unauthorized access to critical data stored within or accessible by Oracle WebCenter Portal. This could result in the exfiltration of sensitive business information, user credentials, or proprietary content hosted on the portal. Furthermore, the vulnerability allows an attacker to cause a hang or frequently repeatable crash of the application, leading to a complete denial of service condition. This means that legitimate users are unable to access services, disrupting business operations and potentially causing significant financial and reputational damage depending on the criticality of the portal's role in the organization.
In terms of industry standard classifications, this vulnerability aligns with CWE-287 Improper Authentication, as it allows unauthenticated actors to perform actions that should be restricted. Additionally, the ability to cause a denial of service through repeated crashes relates closely to CWE-400 Uncontrolled Resource Consumption or CWE-915 Improvement Improperly Controlled Modification of Dynamically-Determined Object Attributes if memory exhaustion is involved in the crash mechanism. From an ATT&CK perspective, this vulnerability facilitates Initial Access via Network Service Exploitation and can be leveraged for Denial of Service attacks under the Disruption or Impact tactics. Attackers may use automated scanning tools to identify vulnerable instances across a network, exploiting them to disrupt services or extract data without detection by traditional authentication-based security controls.
Mitigation strategies must prioritize immediate patching if available from Oracle through critical patch updates specific to these versions. Organizations should ensure that their vulnerability management processes are configured to detect and remediate this specific flaw in the affected 12.2.1.4.0 and 14.1.2.0.0 releases. In cases where immediate patching is not feasible, network-level controls such as Web Application Firewalls can be deployed to filter out malicious HTTP requests targeting Portlet Services endpoints. Implementing strict access control lists on the firewall level to restrict HTTP traffic from untrusted networks or specific IP ranges can also reduce the attack surface. Additionally, enabling comprehensive logging and monitoring for unusual patterns of HTTP requests that result in service hangs or crashes will aid in early detection and incident response efforts. Regular security assessments and penetration testing should be conducted to verify that these mitigations are effective against current threat vectors targeting Oracle Fusion Middleware components.