CVE-2026-60564: Oracle WebCenter Portal Auth Bypass Flaw

CVE-2026-60564 Overview

CVE-2026-60564 is a critical vulnerability in the Runtime Tools component of Oracle WebCenter Portal, part of Oracle Fusion Middleware. A low-privileged attacker with network access over HTTP can compromise the portal without user interaction. The flaw carries a scope change, meaning exploitation impacts resources beyond the vulnerable component. Successful attacks allow unauthorized creation, deletion, or modification of data, as well as unauthorized read access to all WebCenter Portal accessible data. Affected supported versions are 12.2.1.4.0 and 14.1.2.0.0. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Authenticated attackers with minimal privileges can fully compromise confidentiality and integrity of Oracle WebCenter Portal data and impact adjacent products through scope change.

Affected Products

Oracle WebCenter Portal 12.2.1.4.0
Oracle WebCenter Portal 14.1.2.0.0
Oracle Fusion Middleware (Runtime Tools component)

Discovery Timeline

2026-07-21 - CVE CVE-2026-60564 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle releases fix in Critical Patch Update (Oracle CPU July 2026 Security Alert)

Technical Details for CVE-2026-60564

Vulnerability Analysis

The vulnerability resides in the Runtime Tools component of Oracle WebCenter Portal. Runtime Tools handle interactive portal functions accessible to authenticated users, including content contribution, page personalization, and administrative utilities exposed over HTTP.

An attacker holding low-privilege credentials can send crafted HTTP requests that manipulate portal operations outside the authorized scope. Because the attack complexity is low and user interaction is not required, exploitation is straightforward once network access to the portal is available.

The scope change indicated by the CVSS vector is significant. Actions performed against WebCenter Portal propagate to additional Oracle products integrated with the portal, expanding the blast radius beyond the initial target. The Oracle advisory confirms impact on data confidentiality and integrity across all portal-accessible resources.

Root Cause

Oracle has not published detailed root cause information. Based on the advisory metadata, the vulnerability involves insufficient authorization enforcement within Runtime Tools request handlers, allowing low-privileged sessions to invoke operations that read or modify data belonging to other users or trust boundaries.

Attack Vector

Exploitation occurs over the network using standard HTTP requests to the WebCenter Portal application. The attacker must possess valid low-privileged credentials such as a standard portal user account. No social engineering or user interaction is required. Refer to the Oracle CPU July 2026 Security Alert for vendor guidance.

Detection Methods for CVE-2026-60564

Indicators of Compromise

Unexpected HTTP requests to WebCenter Portal Runtime Tools endpoints originating from low-privileged accounts
Portal audit log entries showing creation, deletion, or modification of content by users lacking those permissions
Anomalous cross-component data access between WebCenter Portal and integrated Oracle Fusion Middleware services

Detection Strategies

Enable and review WebCenter Portal audit logging for privilege boundary violations and administrative operations invoked by non-administrative accounts
Correlate web server access logs with authentication events to identify sessions performing actions inconsistent with the account's role
Monitor for HTTP request patterns targeting Runtime Tools URIs at rates or from source addresses inconsistent with normal user behavior

Monitoring Recommendations

Alert on modifications to portal content, pages, or configuration performed by accounts without administrative roles
Track authentication anomalies including logins from new geographies followed by data access spikes
Forward Oracle Fusion Middleware logs to a centralized SIEM for retention and cross-source correlation

How to Mitigate CVE-2026-60564

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update to WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 deployments as the primary remediation
Inventory all Oracle Fusion Middleware installations to confirm patch coverage across production, staging, and disaster recovery environments
Rotate credentials for any portal accounts suspected of misuse and audit recent low-privilege user activity

Patch Information

Oracle released the fix as part of the July 2026 Critical Patch Update. Administrators should download and apply the WebCenter Portal patches referenced in the Oracle CPU July 2026 Security Alert. Oracle typically requires the standard Fusion Middleware OPatch workflow for deployment, followed by domain restart.

Workarounds

Restrict network exposure of the WebCenter Portal application to trusted networks using firewall rules or reverse proxy access control lists
Enforce strong authentication and reduce the number of low-privileged accounts with network access to Runtime Tools
Increase audit logging verbosity for the Runtime Tools component until patching is complete

bash

# Example: restrict access to WebCenter Portal via reverse proxy allowlist
# Apache httpd configuration snippet
<Location /webcenter>
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>