CVE-2026-60730: Oracle WebCenter Portal Auth Bypass Flaw

CVE-2026-60730 Overview

CVE-2026-60730 is an improper access control vulnerability [CWE-284] in the Composer component of Oracle WebCenter Portal, part of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can exploit the issue to compromise Oracle WebCenter Portal. The vulnerability carries a scope change, meaning successful exploitation can impact additional products beyond WebCenter Portal itself. Oracle disclosed the flaw in its August 2026 Critical Patch Update.

Critical Impact
Successful exploitation results in full takeover of Oracle WebCenter Portal, with high impact to confidentiality, integrity, and availability across connected components.

Affected Products

Oracle WebCenter Portal 12.2.1.4.0
Oracle WebCenter Portal 14.1.2.0.0
Oracle Fusion Middleware deployments using the Composer component

Discovery Timeline

2026-08-18 - CVE-2026-60730 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60730

Vulnerability Analysis

The vulnerability resides in the Composer component of Oracle WebCenter Portal. Composer provides runtime page editing and customization capabilities for portal users. Improper access control [CWE-284] in this component allows an authenticated user with limited privileges to perform actions beyond their authorization boundary.

Because the scope changes during exploitation, an attacker can pivot from WebCenter Portal into adjacent Fusion Middleware components. This can expose backend services, integrated identity stores, and other portlets that share the middleware runtime. The result is a complete takeover of the WebCenter Portal instance and material impact to systems it touches.

Root Cause

The root cause is missing or insufficient authorization enforcement in Composer request handlers. Requests that should be restricted to administrative or elevated roles are processed for accounts holding only basic portal access. The component does not validate the caller's entitlements against the sensitive operation being invoked.

Attack Vector

Exploitation requires network reachability to the WebCenter Portal HTTP listener and valid low-privileged credentials. The attack complexity is low and does not require user interaction. An attacker sends crafted HTTP requests to Composer endpoints to invoke privileged operations. The vulnerability details in the Oracle Security Alert confirm remote exploitation over HTTP with only low privileges required.

No public proof-of-concept code is available at the time of publication, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. The EPSS probability for exploitation in the next 30 days is approximately 0.389%.

Detection Methods for CVE-2026-60730

Indicators of Compromise

Unexpected HTTP POST or PUT requests to Composer endpoints under /webcenter/ from accounts that do not normally perform portal customization.
New or modified portal pages, taskflows, or resource catalog entries authored by low-privileged accounts.
Outbound connections initiated by the WebLogic managed server hosting WebCenter Portal to previously unseen internal or external hosts.
Creation of new administrative users, roles, or credential store entries in the Fusion Middleware identity store.

Detection Strategies

Correlate WebCenter Portal access logs with the authenticated user's assigned role to flag privileged operations performed by non-administrative accounts.
Baseline normal Composer usage patterns and alert on anomalous request volume, endpoint paths, or parameter payloads.
Monitor WebLogic audit logs and Oracle Platform Security Services (OPSS) events for authorization failures immediately followed by successful sensitive actions.

Monitoring Recommendations

Enable verbose auditing on the Composer component and forward WebLogic and Fusion Middleware logs to a centralized SIEM.
Track process and file-system activity on the WebCenter Portal managed server for signs of arbitrary artifact deployment.
Review authentication events for the WebCenter Portal identity store to identify credential misuse of low-privileged accounts.

How to Mitigate CVE-2026-60730

Immediate Actions Required

Apply the fixes in Oracle's August 2026 Critical Patch Update as soon as maintenance windows allow.
Inventory all Oracle WebCenter Portal deployments and confirm the version and patch level of each managed server.
Restrict network access to WebCenter Portal HTTP endpoints so that only trusted networks and authenticated users can reach the Composer component.
Audit portal user accounts and revoke unused low-privileged accounts that could be leveraged for exploitation.

Patch Information

Oracle addressed CVE-2026-60730 in the August 2026 Critical Patch Update. Patches are available for supported versions 12.2.1.4.0 and 14.1.2.0.0. Refer to the Oracle Security Alert for download instructions and prerequisite bundle patches. Oracle recommends applying security patches without delay because unsupported and unpatched systems remain exposed to takeover.

Workarounds

If patching must be delayed, place WebCenter Portal behind a reverse proxy or web application firewall and block direct access to Composer administrative paths.
Enforce strict role assignments and remove Composer editing capabilities from any user role that does not explicitly require them.
Rotate credentials for portal service accounts and require multi-factor authentication for portal logins where supported.

bash

# Example: restrict access to Composer endpoints at the reverse proxy
# Deny non-administrative source ranges from reaching Composer URIs
location ~* ^/webcenter/.*composer {
    allow 10.10.0.0/24;   # administrator subnet
    deny  all;
    proxy_pass http://webcenter_backend;
}