Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-60566: Oracle WebCenter Portal Takeover via HTTP
CVE-2026-60566
Summary
The Oracle WebCenter Portal, a tool for creating and managing websites, has a security flaw that allows hackers to take control of the system without needing a password. This is a serious issue because it could allow hackers to access sensitive information and disrupt the website's functionality. Oracle recommends updating to a fixed version to prevent this takeover.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| oracle | webcenter_portal |
12.2.1.4.0 14.1.2.0.0 cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:* |
Original title
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable...
Original description
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
nvd CVSS3.1
9.8
- https://www.oracle.com/security-alerts/cpujul2026.html Vendor Advisory
Published: 21 Jul 2026 · Updated: 25 Jul 2026 · First seen: 24 Jul 2026