CVE-2026-60554: Oracle WebCenter Sites Information Leak

CVE-2026-60554 Overview

CVE-2026-60554 affects Oracle WebCenter Sites, a component of Oracle Fusion Middleware. The flaw allows an unauthenticated attacker with network access via HTTP to compromise confidentiality of the application. Successful exploitation results in unauthorized access to critical data or complete read access to all Oracle WebCenter Sites accessible data. Oracle disclosed the issue in the July 2026 Critical Patch Update. The vulnerability requires no user interaction and can be triggered remotely with low attack complexity.

Critical Impact
Unauthenticated remote attackers can retrieve all data accessible to Oracle WebCenter Sites through HTTP requests, without user interaction or privileges.

Affected Products

Oracle WebCenter Sites 12.2.1.4.0
Oracle WebCenter Sites 14.1.2.0.0
Oracle Fusion Middleware (WebCenter Sites component)

Discovery Timeline

2026-07-21 - CVE CVE-2026-60554 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle publishes Critical Patch Update advisory (Oracle Security Alert - July 2026)

Technical Details for CVE-2026-60554

Vulnerability Analysis

The vulnerability resides within the WebCenter Sites component of Oracle Fusion Middleware. It exposes an HTTP-accessible interface that fails to properly authorize requests before returning sensitive application data. An attacker sending crafted HTTP requests can bypass access controls and retrieve information restricted to authenticated users or administrators.

The issue impacts confidentiality only. Integrity and availability of the affected system are not directly affected by exploitation. Because Oracle WebCenter Sites is typically deployed as a public-facing content delivery and management platform, exposed instances are reachable from untrusted networks.

The EPSS score of 0.398% places CVE-2026-60554 in the 32nd percentile for expected exploitation activity at time of publication. Oracle has not disclosed whether public exploitation has been observed.

Root Cause

Oracle's advisory categorizes the issue as an information disclosure flaw in the WebCenter Sites component. The root cause is missing or insufficient authorization enforcement on an HTTP-reachable endpoint. Requests that should require authentication are processed and return protected data to anonymous callers.

Attack Vector

Exploitation occurs over the network via HTTP. The attacker requires no credentials, no prior access, and no interaction from a user. A single crafted request is sufficient to trigger data exposure. Any Oracle WebCenter Sites deployment reachable from an attacker-controlled network segment is exposed until patched.

See the Oracle Security Alert - July 2026 for vendor technical details.

Detection Methods for CVE-2026-60554

Indicators of Compromise

Anomalous HTTP GET or POST requests to Oracle WebCenter Sites endpoints from unauthenticated sources.
Large volumes of successful HTTP 200 responses returning content-management data to unauthenticated clients.
Requests originating from external IP ranges targeting WebCenter Sites administrative or content-delivery URIs.

Detection Strategies

Review web server and application access logs for unauthenticated requests that returned protected content resources.
Baseline normal traffic to WebCenter Sites and alert on statistical deviations in response size, endpoint access patterns, or geography.
Deploy web application firewall (WAF) rules that inspect requests targeting WebCenter Sites paths and flag anomalous parameters.

Monitoring Recommendations

Forward Oracle WebCenter Sites and fronting web server logs to a centralized analytics platform for correlation and long-term retention.
Monitor egress bandwidth from WebCenter Sites hosts for signs of bulk data extraction.
Alert on repeated requests from single source IPs to WebCenter Sites endpoints outside expected user workflows.

How to Mitigate CVE-2026-60554

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update to all Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 deployments.
Inventory all internet-facing WebCenter Sites instances and prioritize patching for externally reachable systems first.
Review historical web server access logs for potential prior exploitation attempts against the affected endpoints.

Patch Information

Oracle addresses CVE-2026-60554 in the July 2026 Critical Patch Update. Administrators should download and apply the WebCenter Sites patch bundle referenced in the Oracle Security Alert - July 2026. Oracle strongly recommends applying Critical Patch Update fixes without delay because the vendor does not provide standalone patches for individual issues.

Workarounds

Restrict network access to Oracle WebCenter Sites administrative and non-public endpoints using firewall or reverse proxy rules until the patch is applied.
Place affected servers behind an authenticating reverse proxy that enforces access control at the network perimeter.
Enable WAF signatures targeting anomalous requests to known WebCenter Sites URIs and rate-limit unauthenticated traffic.

bash

# Example: restrict WebCenter Sites admin paths at the reverse proxy (nginx)
location ~* ^/(cs|sites|Xcelerate|webcenter)/ {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    proxy_pass http://webcenter_backend;
}