CVE-2026-60557: Oracle WebCenter Sites Disclosure Flaw

CVE-2026-60557 Overview

CVE-2026-60557 is an information disclosure vulnerability in Oracle WebCenter Sites, a component of Oracle Fusion Middleware. The flaw allows an unauthenticated remote attacker with HTTP network access to compromise the product when a legitimate user is tricked into interacting with attacker-controlled content. Successful exploitation results in unauthorized access to critical data or complete read access to all data accessible through Oracle WebCenter Sites. The vulnerability affects supported versions 12.2.1.4.0 and 14.1.2.0.0. Oracle disclosed the issue in the Oracle July 2026 Security Alert.

Critical Impact
An unauthenticated attacker can obtain complete read access to all data accessible via Oracle WebCenter Sites when a user is lured into interacting with attacker-controlled input.

Affected Products

Oracle WebCenter Sites 12.2.1.4.0
Oracle WebCenter Sites 14.1.2.0.0
Oracle Fusion Middleware (WebCenter Sites component)

Discovery Timeline

2026-07-21 - CVE-2026-60557 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle publishes fix in the Oracle July 2026 Security Alert

Technical Details for CVE-2026-60557

Vulnerability Analysis

CVE-2026-60557 is a network-exploitable information disclosure flaw in the WebCenter Sites component of Oracle Fusion Middleware. Oracle rates it as easily exploitable over HTTP without prior authentication. Exploitation does require human interaction from a user other than the attacker, which typically indicates a client-mediated attack path such as a crafted link or embedded content.

The impact is confined to confidentiality. Oracle states that a successful attack yields unauthorized access to critical data or complete access to all data accessible to WebCenter Sites. Integrity and availability are not affected. The EPSS probability at publication was 0.352% (percentile 27.69), indicating limited observed exploitation activity at time of disclosure.

Root Cause

Oracle has not published a detailed technical root cause in the public advisory. The requirement for user interaction combined with a confidentiality-only impact is consistent with client-triggered information disclosure patterns, such as reflected content handling or cross-origin data exposure in the WebCenter Sites web interface. See the Oracle July 2026 Security Alert for vendor-supplied technical details.

Attack Vector

The attacker delivers a crafted URL or web request to a legitimate WebCenter Sites user. When the user interacts with the attacker-controlled input, the WebCenter Sites application returns data that the attacker can capture. Because no authentication is required on the attacker side, the exploitation chain relies on tricking a victim rather than compromising credentials.

No verified public proof-of-concept code is available at this time. Refer to the vendor advisory for exploitation prerequisites and configuration-specific conditions.

Detection Methods for CVE-2026-60557

Indicators of Compromise

Unusual outbound HTTP requests from WebCenter Sites users to unfamiliar external domains shortly before anomalous data retrieval events.
WebCenter Sites access logs containing crafted query strings, encoded payloads, or unexpected referrers targeting content-delivery endpoints.
Spikes in read access to sensitive content assets from single sessions or IP addresses.

Detection Strategies

Correlate WebCenter Sites application logs with web proxy and email gateway logs to identify user interaction with attacker-supplied URLs.
Alert on anomalous volumes of authenticated read operations returning restricted content types.
Inspect HTTP responses for content that should not be returned to the requesting user context.

Monitoring Recommendations

Enable verbose access logging on WebCenter Sites front-end and delivery servers, including full request URIs and referrers.
Forward Oracle Fusion Middleware logs to a centralized SIEM for retention and correlation.
Monitor for phishing campaigns referencing internal WebCenter Sites hostnames or URL patterns.

How to Mitigate CVE-2026-60557

Immediate Actions Required

Apply the July 2026 Critical Patch Update from Oracle to WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 installations.
Inventory all Oracle Fusion Middleware deployments to identify exposed WebCenter Sites instances, particularly internet-facing delivery tiers.
Brief users with WebCenter Sites access on the risk of clicking untrusted links that reference the application.

Patch Information

Oracle addressed CVE-2026-60557 in the Oracle July 2026 Security Alert. Administrators should apply the corresponding Critical Patch Update bundle for their WebCenter Sites version and validate the fix in a staging environment before production rollout.

Workarounds

Restrict WebCenter Sites administrative and authoring interfaces to trusted networks using firewall or reverse-proxy access controls.
Deploy a web application firewall rule set to inspect and filter suspicious request parameters directed at WebCenter Sites endpoints.
Enforce strict Content Security Policy and referrer policies on WebCenter Sites delivery hosts to reduce client-mediated exploitation surface.

bash

# Example: restrict WebCenter Sites admin endpoints via reverse proxy allowlist
location /cs/ {
    allow 10.0.0.0/8;
    deny  all;
    proxy_pass http://webcenter-sites-backend;
}