CVE-2026-60565: Oracle WebCenter Portal Auth Bypass Flaw

CVE-2026-60565 Overview

CVE-2026-60565 is a critical vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware. The flaw resides in the Runtime Tools component and affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can exploit this vulnerability to compromise Oracle WebCenter Portal. The vulnerability includes a scope change, meaning successful exploitation can significantly impact additional products beyond WebCenter Portal itself. Successful attacks result in full takeover of the affected Oracle WebCenter Portal instance, compromising confidentiality, integrity, and availability.

Critical Impact
Authenticated attackers with minimal privileges can achieve complete takeover of Oracle WebCenter Portal over the network, with impact extending to adjacent systems due to scope change.

Affected Products

Oracle WebCenter Portal version 12.2.1.4.0
Oracle WebCenter Portal version 14.1.2.0.0
Oracle Fusion Middleware (Runtime Tools component)

Discovery Timeline

2026-07-21 - CVE-2026-60565 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in Oracle Critical Patch Update advisory

Technical Details for CVE-2026-60565

Vulnerability Analysis

The vulnerability affects the Runtime Tools component of Oracle WebCenter Portal, a web-based collaboration and portal platform within Oracle Fusion Middleware. Oracle classifies the flaw as easily exploitable, requiring only low privileges and network access over HTTP. No user interaction is required for exploitation.

The scope change indicates that the vulnerable component can affect resources beyond its own security authority. An attacker exploiting this flaw in WebCenter Portal can pivot to compromise additional Oracle Fusion Middleware components sharing trust boundaries. Full compromise of confidentiality, integrity, and availability is achievable.

The EPSS score of 0.447% indicates a lower probability of exploitation in the short term, but the impact severity warrants immediate remediation.

Root Cause

Oracle has not published detailed root cause information in the public advisory. Based on the attack characteristics — low complexity, low privileges, network vector, and scope change — the flaw likely stems from insufficient authorization checks or unsafe input handling within Runtime Tools endpoints exposed to authenticated users. Consult the Oracle Security Alert July 2026 for vendor-specific technical details.

Attack Vector

An authenticated attacker sends crafted HTTP requests to the Runtime Tools endpoints of a vulnerable Oracle WebCenter Portal deployment. Because only low privileges are required, any user with basic portal access can attempt exploitation. Successful requests result in takeover of the portal application and potential lateral impact on integrated Fusion Middleware services through the scope change condition.

No public proof-of-concept code is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Oracle Critical Patch Update advisory for verified technical details.

Detection Methods for CVE-2026-60565

Indicators of Compromise

Unexpected HTTP requests to Oracle WebCenter Portal Runtime Tools endpoints from low-privileged accounts
Anomalous administrative actions performed by non-administrator portal users
Unusual outbound connections or process spawning from Oracle Fusion Middleware application servers
New or modified portal artifacts, deployed applications, or scheduled tasks without change-management records

Detection Strategies

Review WebLogic and WebCenter Portal access logs for suspicious Runtime Tools requests, especially from accounts without administrative roles
Correlate authentication events with subsequent privilege-sensitive actions inside WebCenter Portal
Baseline normal HTTP request patterns against Runtime Tools URLs and alert on deviations
Monitor Oracle Fusion Middleware audit logs for scope-crossing operations affecting integrated services

Monitoring Recommendations

Forward WebLogic Server, WebCenter Portal, and Fusion Middleware audit logs to a centralized SIEM for correlation
Alert on process execution, file writes, and outbound network activity originating from the WebCenter Portal JVM process
Track configuration changes to portal applications, connections, and service accounts
Enable verbose HTTP request logging on portal front-end servers until patching is complete

How to Mitigate CVE-2026-60565

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 deployments
Inventory all Oracle Fusion Middleware instances and validate patch status against the vendor advisory
Restrict network access to WebCenter Portal management and Runtime Tools endpoints to trusted networks only
Audit low-privileged portal accounts and remove unused or stale credentials

Patch Information

Oracle addressed CVE-2026-60565 in the July 2026 Critical Patch Update. Administrators should download and install the appropriate patch bundle for their WebCenter Portal version from the Oracle Security Alert July 2026 advisory. Oracle recommends applying Critical Patch Update patches without delay because unpatched systems have been repeatedly targeted in prior years.

Workarounds

Place WebCenter Portal behind a web application firewall configured to inspect and rate-limit Runtime Tools requests
Enforce network segmentation isolating Fusion Middleware servers from general user networks
Require multi-factor authentication for all portal user accounts, including low-privileged roles
Disable or restrict access to non-essential Runtime Tools features until patching is verified

bash

# Example: restrict access to Runtime Tools paths via reverse proxy (nginx)
location ~* /webcenter/.*runtime.* {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://webcenter_backend;
}