CVE-2026-60562: Oracle WebCenter Portal Auth Bypass Flaw

CVE-2026-60562 Overview

CVE-2026-60562 is a critical vulnerability in the Runtime Tools component of Oracle WebCenter Portal, part of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can exploit this vulnerability to compromise Oracle WebCenter Portal. Successful exploitation results in full takeover of the affected portal instance. The scope change component means attacks can significantly impact additional products beyond the vulnerable WebCenter Portal itself.

Critical Impact
Remote authenticated attackers can take over Oracle WebCenter Portal with high impact to confidentiality, integrity, and availability, and impact extends beyond the vulnerable component into connected systems.

Affected Products

Oracle WebCenter Portal 12.2.1.4.0
Oracle WebCenter Portal 14.1.2.0.0
Oracle Fusion Middleware (Runtime Tools component)

Discovery Timeline

2026-07-21 - CVE CVE-2026-60562 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in Oracle Critical Patch Update Advisory

Technical Details for CVE-2026-60562

Vulnerability Analysis

The vulnerability resides in the Runtime Tools component of Oracle WebCenter Portal, a web-based platform used to build enterprise portals, composite applications, and social networking sites. Oracle classifies the flaw as easily exploitable over HTTP, requiring only low privileges and no user interaction. Successful exploitation results in full takeover of the WebCenter Portal instance.

The scope change indicator signals that the vulnerability crosses a trust boundary. Compromising the portal can therefore affect the confidentiality, integrity, and availability of connected Fusion Middleware components, backend data stores, and integrated enterprise applications.

Oracle's advisory does not disclose the specific weakness class. Historical WebCenter Portal issues have involved deserialization flaws, path traversal, and improper authorization in runtime servlet endpoints. Administrators should treat the flaw as capable of enabling arbitrary operations under the portal's service account.

Root Cause

The underlying defect is in the Runtime Tools subsystem of WebCenter Portal. Oracle has not published root-cause details in the public advisory. The reference for further technical information is the Oracle Security Alert CPU July 2026.

Attack Vector

An attacker with an authenticated low-privilege account sends crafted HTTP requests to Runtime Tools endpoints exposed by WebCenter Portal. No user interaction is required. Because attack complexity is low and the attack originates over the network, exposure of the WebCenter Portal application to untrusted networks materially increases risk.

No verified proof-of-concept code is publicly available. Refer to the vendor advisory for authoritative technical details.

Detection Methods for CVE-2026-60562

Indicators of Compromise

Unexpected HTTP POST or GET requests to WebCenter Portal Runtime Tools URIs from unusual source addresses or accounts.
New or modified WebCenter application artifacts, deployed pages, or portlet configurations without a corresponding change record.
Portal service account processes spawning shells, java child processes, or invoking system utilities such as curl, wget, or bash.
Outbound network connections from the WebCenter Portal host to previously unseen IP addresses or domains.

Detection Strategies

Review WebLogic and WebCenter Portal access logs for high-frequency or malformed requests targeting Runtime Tools endpoints.
Correlate authentication events for low-privileged accounts with sensitive administrative actions on the portal.
Baseline normal portal process behavior and alert on deviations such as unexpected file writes under Oracle middleware directories.

Monitoring Recommendations

Forward WebLogic Server, WebCenter Portal, and operating system logs to a centralized SIEM for correlation.
Enable web application firewall (WAF) inspection in front of WebCenter Portal with rules for anomalous request payloads.
Monitor Oracle service accounts for lateral movement attempts into connected databases, LDAP, and content repositories.

How to Mitigate CVE-2026-60562

Immediate Actions Required

Apply the fixes published in the Oracle Critical Patch Update for July 2026 to all affected WebCenter Portal deployments.
Restrict network access to WebCenter Portal Runtime Tools endpoints to trusted management networks only.
Audit and rotate credentials for low-privileged portal accounts that could be used to reach the vulnerable component.
Review WebCenter Portal deployments, connected data sources, and integrated applications for signs of unauthorized changes.

Patch Information

Oracle addressed CVE-2026-60562 in the July 2026 Critical Patch Update. Full remediation details, patch numbers, and applicability guidance are available in the Oracle Security Alert CPU July 2026. Apply the patch set updates provided for Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0.

Workarounds

Place WebCenter Portal behind an authenticating reverse proxy or WAF that blocks direct access to Runtime Tools URIs.
Enforce network segmentation between the portal tier and backend Fusion Middleware components to limit scope-change impact.
Disable or restrict unused WebCenter Portal Runtime Tools features until patches can be applied.

bash

# Example: restrict access to WebCenter Portal Runtime Tools via reverse proxy
# NGINX configuration snippet
location ~* /webcenter/runtime {
    allow 10.0.0.0/24;   # management subnet
    deny  all;
    proxy_pass http://webcenter_backend;
}