CVE-2026-60563: Oracle WebCenter Portal Auth Bypass Flaw

CVE-2026-60563 Overview

CVE-2026-60563 affects the Runtime Tools component of Oracle WebCenter Portal, a product within Oracle Fusion Middleware. Oracle disclosed the vulnerability in the July 2026 Critical Patch Update. Supported versions 12.2.1.4.0 and 14.1.2.0.0 are affected.

An attacker with low privileges and network access via HTTP can compromise the WebCenter Portal instance. Successful exploitation results in full takeover of Oracle WebCenter Portal, impacting confidentiality, integrity, and availability.

Critical Impact
A low-privileged, remote attacker can take over Oracle WebCenter Portal deployments running versions 12.2.1.4.0 or 14.1.2.0.0 over HTTP without user interaction.

Affected Products

Oracle WebCenter Portal 12.2.1.4.0
Oracle WebCenter Portal 14.1.2.0.0
Oracle Fusion Middleware — Runtime Tools component

Discovery Timeline

2026-07-21 - CVE-2026-60563 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update Advisory - July 2026

Technical Details for CVE-2026-60563

Vulnerability Analysis

The vulnerability resides in the Runtime Tools component of Oracle WebCenter Portal. Oracle's advisory classifies the flaw as easily exploitable over the network via HTTP. An authenticated attacker holding only low-level privileges can achieve full compromise of the portal.

The impact scope covers confidentiality, integrity, and availability at a high level. Because the attack complexity is low and no user interaction is required, exploitation is practical against exposed WebCenter Portal instances. The EPSS score is 0.328% at the 25th percentile, indicating no widespread exploitation activity observed at publication time.

Oracle has not published detailed root-cause information. The Runtime Tools component provides administrative and runtime configuration surfaces within WebCenter Portal, which are common targets for authentication and authorization weaknesses in Fusion Middleware products.

Root Cause

Oracle's advisory does not disclose the specific defect class in the Runtime Tools component. The combination of low privilege requirement, network attack vector, and full compromise outcome is consistent with broken access control or injection weaknesses in privileged runtime interfaces. Refer to the Oracle Security Alert - July 2026 for authoritative details.

Attack Vector

The attacker must have HTTP access to the WebCenter Portal instance and possess valid low-privileged credentials. From there, requests to the Runtime Tools component allow the attacker to escalate access and take control of the portal. No user interaction is required, and the scope remains unchanged.

No public proof-of-concept exploit or exploit-in-the-wild activity has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-60563

Indicators of Compromise

Unexpected authenticated HTTP requests to Runtime Tools endpoints from low-privileged accounts.
Creation, modification, or elevation of WebCenter Portal user roles outside normal administrative workflows.
Anomalous configuration changes or new administrative artifacts within the WebCenter Portal runtime.
Outbound connections initiated from the WebCenter Portal application server to unfamiliar hosts.

Detection Strategies

Review Oracle WebLogic and WebCenter Portal access logs for HTTP requests targeting Runtime Tools paths made by non-administrative users.
Correlate authentication events with subsequent privilege changes in the portal to surface abuse of low-privileged accounts.
Compare running WebCenter Portal versions against 12.2.1.4.0 and 14.1.2.0.0 to prioritize monitoring on affected hosts.

Monitoring Recommendations

Forward WebLogic Server, WebCenter Portal, and OHS access logs to a centralized SIEM with retention sufficient for incident investigation.
Alert on privilege changes, role assignments, and configuration modifications originating from Runtime Tools components.
Baseline normal HTTP traffic patterns to Runtime Tools URIs and alert on deviations by source account or IP.

How to Mitigate CVE-2026-60563

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 deployments.
Inventory all Oracle Fusion Middleware instances to confirm patch coverage across production, staging, and disaster-recovery environments.
Restrict network reachability of WebCenter Portal to trusted networks and enforce authentication proxies where feasible.
Rotate credentials for low-privileged WebCenter Portal accounts and audit recently created accounts.

Patch Information

Oracle addressed CVE-2026-60563 in the July 2026 Critical Patch Update. Administrators should follow the guidance in the Oracle Critical Patch Update Advisory - July 2026 and apply the fixes for Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0.

Workarounds

Limit HTTP access to Runtime Tools URIs at the reverse proxy or Oracle HTTP Server tier until patches are deployed.
Enforce least privilege on WebCenter Portal accounts and remove unused low-privileged accounts that could be leveraged by attackers.
Place WebCenter Portal instances behind a web application firewall configured to inspect and rate-limit requests to administrative components.

bash

# Example: restrict access to Runtime Tools paths at Oracle HTTP Server
<Location /webcenter/runtime>
    Order deny,allow
    Deny from all
    Allow from 10.0.0.0/8
    Require valid-user
</Location>