CVE-2026-60561 Overview
CVE-2026-60561 is a critical vulnerability in the Runtime Tools component of Oracle WebCenter Portal, part of Oracle Fusion Middleware. A low-privileged attacker with network access over HTTP can compromise the product without user interaction. Successful exploitation results in full takeover of Oracle WebCenter Portal and can extend to additional products due to a scope change. Oracle disclosed the issue in the July 2026 Critical Patch Update.
Critical Impact
A low-privileged remote attacker can take over Oracle WebCenter Portal over HTTP with confidentiality, integrity, and availability impact extending beyond the vulnerable component.
Affected Products
- Oracle WebCenter Portal 12.2.1.4.0
- Oracle WebCenter Portal 14.1.2.0.0
- Oracle Fusion Middleware (Runtime Tools component)
Discovery Timeline
- 2026-07-21 - CVE CVE-2026-60561 published to NVD
- 2026-07-21 - Last updated in NVD database
- July 2026 - Addressed in the Oracle Security Alert July 2026
Technical Details for CVE-2026-60561
Vulnerability Analysis
The vulnerability resides in the Runtime Tools component of Oracle WebCenter Portal. An authenticated attacker holding low privileges can send crafted HTTP requests to compromise the portal. Oracle classifies the flaw as easily exploitable, meaning no specialized conditions are required to trigger the code path.
The scope change indicator signals that exploitation affects resources beyond the vulnerable component. An attacker who takes over the portal can pivot into connected Fusion Middleware services and downstream applications. Confidentiality, integrity, and availability are all fully impacted.
Root Cause
Oracle has not published detailed root cause information. Based on the vector and affected component, the flaw involves insufficient authorization or input handling within Runtime Tools request processing. The scope change indicates the affected process operates with authority over resources beyond the WebCenter Portal component itself.
Attack Vector
Exploitation requires network reachability to the WebCenter Portal HTTP interface and valid low-privilege credentials. The attacker sends a crafted HTTP request to the vulnerable Runtime Tools endpoint. No user interaction is required, and attack complexity is low. Successful exploitation yields full control of the portal, enabling data theft, content manipulation, and disruption of dependent services.
Detailed exploitation code has not been published. Refer to the Oracle Security Alert July 2026 for vendor-provided technical context.
Detection Methods for CVE-2026-60561
Indicators of Compromise
- Unexpected administrative actions performed by low-privileged WebCenter Portal accounts.
- Anomalous HTTP requests targeting Runtime Tools endpoints under /webcenter/ or related Fusion Middleware paths.
- New or modified portal content, connections, or service configurations created outside change windows.
- Outbound connections from the WebCenter Portal host to unfamiliar destinations.
Detection Strategies
- Review WebLogic and WebCenter Portal access logs for HTTP requests to Runtime Tools URLs originating from standard user sessions.
- Correlate authentication events with privileged actions to identify low-privilege accounts performing administrative operations.
- Baseline normal Runtime Tools traffic and alert on deviations in request volume, parameters, or user agents.
Monitoring Recommendations
- Forward WebLogic, WebCenter Portal, and OHS access logs to a centralized analytics platform for correlation.
- Monitor process execution and outbound network traffic on Fusion Middleware hosts for signs of post-exploitation activity.
- Alert on configuration or account changes within WebCenter Portal administration interfaces.
How to Mitigate CVE-2026-60561
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update fixes for WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 without delay.
- Restrict network access to WebCenter Portal HTTP endpoints to trusted management networks and required user segments.
- Rotate credentials for accounts with access to WebCenter Portal, especially service and low-privilege accounts.
- Audit portal accounts and remove unused or excessive access to reduce the attack surface.
Patch Information
Oracle addressed CVE-2026-60561 in the July 2026 Critical Patch Update. Administrators should download and apply the patches referenced in the Oracle Security Alert July 2026 for the affected WebCenter Portal versions. Verify patch application by checking the OPatch inventory after installation.
Workarounds
- No official workaround has been published by Oracle; patching is the required remediation.
- Where immediate patching is not possible, place WebCenter Portal behind a web application firewall and block access to Runtime Tools paths for non-administrative users.
- Enforce network segmentation so Fusion Middleware components are not reachable from untrusted networks.
# Verify OPatch inventory after applying the July 2026 CPU
$ORACLE_HOME/OPatch/opatch lsinventory | grep -i webcenter
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
