CVE-2026-60555: Oracle WebCenter Sites RCE Vulnerability

CVE-2026-60555 Overview

CVE-2026-60555 is a critical vulnerability in Oracle WebCenter Sites, a component of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can exploit this vulnerability to fully compromise Oracle WebCenter Sites. Successful exploitation results in complete takeover of the affected instance, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Unauthenticated remote attackers can take over Oracle WebCenter Sites deployments through network-accessible HTTP endpoints, leading to full compromise of hosted content, credentials, and backend systems.

Affected Products

Oracle WebCenter Sites 12.2.1.4.0
Oracle WebCenter Sites 14.1.2.0.0
Oracle Fusion Middleware (WebCenter Sites component)

Discovery Timeline

2026-07-21 - CVE CVE-2026-60555 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Security Alert July 2026

Technical Details for CVE-2026-60555

Vulnerability Analysis

CVE-2026-60555 affects the WebCenter Sites component of Oracle Fusion Middleware. Oracle characterizes the issue as easily exploitable and reachable over HTTP without authentication. Successful exploitation yields full takeover, meaning an attacker gains control comparable to that of the application itself.

WebCenter Sites is a web experience management platform hosting public-facing content, editorial workflows, and integrations with backend systems. A takeover on this tier typically exposes CMS content, editor credentials, template code, and connected data stores. Attackers can pivot from a compromised WebCenter Sites node into adjacent Fusion Middleware services.

Oracle has not published exploitation mechanics beyond the CVSS profile. Refer to the Oracle Security Alert July 2026 for advisory details and fixed builds.

Root Cause

Oracle has not disclosed the specific root cause or [CWE] category for this issue. The advisory indicates the vulnerability resides in the WebCenter Sites component and requires no privileges or user interaction, which is consistent with a network-reachable pre-authentication defect in an HTTP-facing handler.

Attack Vector

The attack vector is network-based. An attacker sends crafted HTTP requests to an exposed Oracle WebCenter Sites endpoint. No credentials, prior access, or user interaction are required. Deployments exposed to the internet or untrusted internal networks are directly reachable by opportunistic scanners.

Oracle has not released technical exploitation details. See the Oracle Security Alert July 2026 for vendor guidance.

Detection Methods for CVE-2026-60555

Indicators of Compromise

Unexpected HTTP POST or PUT requests to Oracle WebCenter Sites administrative or content-delivery paths from external or unknown source IP addresses.
Creation of new administrator or editorial accounts, unexpected template modifications, or new scheduled tasks in WebCenter Sites.
Outbound network connections from the WebCenter Sites application server to attacker-controlled infrastructure following anomalous HTTP traffic.
New processes spawned by the WebLogic or WebCenter Sites Java processes, particularly shells or scripting interpreters.

Detection Strategies

Inspect WebCenter Sites and fronting web server logs for anomalous request patterns, oversized payloads, or unauthenticated access to management URIs.
Correlate application server process telemetry with HTTP access logs to surface post-request child process creation.
Baseline outbound network traffic from Fusion Middleware hosts and alert on deviations to previously unseen destinations.

Monitoring Recommendations

Forward WebCenter Sites, WebLogic, and reverse proxy logs into a centralized analytics platform for correlation and retention.
Monitor file integrity on WebCenter Sites installation directories, template stores, and shared file systems for unauthorized changes.
Alert on authentication events and privilege changes within WebCenter Sites administrative consoles.

How to Mitigate CVE-2026-60555

Immediate Actions Required

Apply the fixes documented in the Oracle Security Alert July 2026 to all Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 instances.
Inventory internet-exposed WebCenter Sites deployments and restrict access to trusted networks until patched.
Rotate administrative credentials, API keys, and integration secrets used by WebCenter Sites after patching.
Review authentication logs, content changes, and application server activity for the period preceding patch deployment.

Patch Information

Oracle addressed CVE-2026-60555 in the July 2026 Critical Patch Update. Administrators should follow the version and patch guidance published in the Oracle Security Alert July 2026 for both 12.2.1.4.0 and 14.1.2.0.0 release trains.

Workarounds

Place WebCenter Sites behind a web application firewall or reverse proxy that restricts access to authenticated management paths.
Limit inbound HTTP access to WebCenter Sites administrative endpoints using network ACLs or VPN-only access.
Disable or firewall off any WebCenter Sites interfaces that are not required for production use until patches are applied.

bash

# Example: restrict inbound HTTP access to WebCenter Sites to trusted management subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP