CVE-2026-60730 in WebCenter Portal
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. While the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Composer component of Oracle WebCenter Portal, a key element of the Oracle Fusion Middleware suite. This security flaw affects specific supported releases, namely version 12.2.1.4.0 and version 14.1.2.0.0. The nature of this defect is particularly severe because it permits an attacker with low privileges to execute unauthorized actions over a network connection using the HTTP protocol. Unlike many vulnerabilities that require user interaction or high-level administrative access, this flaw can be exploited remotely by attackers who have already gained basic authenticated access to the system. This significantly lowers the barrier for entry, allowing individuals with minimal initial credentials to escalate their influence within the application environment.
The technical mechanism of the exploit allows for a complete compromise of the Oracle WebCenter Portal instance. The vulnerability enables an attacker to take full control over the portal infrastructure, which translates directly into high-impact consequences across confidentiality, integrity, and availability dimensions. This is reflected in the CVSS 3.1 Base Score of 9.9, indicating critical severity. The vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) confirms that the attack has a network-based scope with low complexity and requires only low privileges to initiate. Crucially, the presence of S:C in the vector indicates a scope change, meaning that while the vulnerability is technically located within Oracle WebCenter Portal, its exploitation can lead to security breaches in other connected or dependent products within the broader enterprise architecture. This lateral movement capability amplifies the risk profile significantly beyond the immediate application layer.
From an operational perspective, successful exploitation results in total takeover of the affected portal service. An attacker gaining this level of access can manipulate content, exfiltrate sensitive data stored within the portal, disrupt services for end-users, and potentially use the compromised server as a pivot point to attack other systems on the internal network. The impact on confidentiality is high, allowing unauthorized reading of protected information. Integrity impacts are equally severe, permitting malicious modification or deletion of critical web content and configurations. Availability is also critically affected, as attackers can render the service inaccessible through denial-of-service techniques or by corrupting essential system files. This comprehensive impact aligns with CWE classifications for privilege escalation and insecure direct object references, where insufficient access control checks allow users to act beyond their intended permissions.
In terms of threat modeling, this vulnerability maps closely to MITRE ATT&CK tactics involving Initial Access via valid accounts and Privilege Escalation through exploitation of application logic flaws. The ability to move laterally due to the scope change suggests potential alignment with techniques related to Lateral Movement using compromised credentials or system resources. Organizations relying on these specific versions must recognize that this is not an isolated incident but a systemic risk that could destabilize multiple integrated services.
Mitigation strategies should prioritize immediate patching of Oracle WebCenter Portal to the latest available version provided by Oracle, which addresses the underlying code defects in the Composer component. Until patches are applied, network segmentation and strict firewall rules limiting HTTP access to only authorized IP ranges can reduce the attack surface. Additionally, implementing robust identity and access management policies ensures that even if an attacker gains low-level credentials, their ability to exploit this specific flaw is constrained by additional security controls such as multi-factor authentication for administrative functions and rigorous monitoring of unusual activity patterns within the portal logs. Regular vulnerability assessments focused on middleware components are essential to detect similar misconfigurations or unpatched flaws before they can be weaponized.