CVE-2026-60733 Overview
CVE-2026-60733 is an access control weakness [CWE-284] in the Composer component of Oracle WebCenter Portal, part of Oracle Fusion Middleware. Authenticated attackers with low privileges can reach the vulnerable component over HTTP and abuse it to compromise the portal. The flaw carries a scope change, meaning successful exploitation impacts resources beyond the vulnerable component. Oracle published the fix in the Critical Security Patch Update for August 2026.
Critical Impact
Successful exploitation enables unauthorized creation, deletion, or modification of critical WebCenter Portal data, read access to a subset of portal data, and a partial denial of service against the portal.
Affected Products
- Oracle WebCenter Portal 12.2.1.4.0
- Oracle WebCenter Portal 14.1.2.0.0
- Oracle Fusion Middleware (WebCenter Portal Composer component)
Discovery Timeline
- 2026-08-18 - CVE-2026-60733 published to the National Vulnerability Database
- 2026-08-20 - Last updated in the NVD database
Technical Details for CVE-2026-60733
Vulnerability Analysis
The vulnerability resides in the Composer component of Oracle WebCenter Portal, which handles page composition and content editing. An attacker with a low-privileged account can send crafted HTTP requests to the Composer component and bypass intended access restrictions. Because the vulnerability produces a scope change, exploitation influences components outside the immediate security authority of WebCenter Portal.
Successful exploitation yields high integrity impact, allowing unauthorized creation, deletion, or modification of critical data across portal-accessible resources. Confidentiality and availability impacts are limited, producing partial data disclosure and partial denial of service. The attack is difficult to execute, requiring specific conditions and knowledge of the target environment.
Root Cause
The issue maps to [CWE-284] Improper Access Control. The Composer component fails to fully enforce authorization checks on requests originating from low-privileged authenticated users. The absence of consistent access verification lets an attacker perform actions that should be restricted to higher-privileged roles.
Attack Vector
Exploitation occurs over the network using HTTP against a reachable WebCenter Portal instance. The attacker must hold a valid low-privileged account to authenticate before triggering the vulnerable Composer functionality. No user interaction is required from another party. Refer to the Oracle Security Alert CSPUAUG2026 for vendor technical guidance.
Detection Methods for CVE-2026-60733
Indicators of Compromise
- Unexpected HTTP requests to Composer endpoints under /webcenter/ or /wcps/ paths from low-privileged accounts.
- Unauthorized creation, modification, or deletion of portal pages, resources, or content assets that lack an associated administrative approval record.
- Anomalous authentication activity from service or low-tier user accounts immediately preceding portal content changes.
Detection Strategies
- Correlate WebCenter Portal audit logs with web server access logs to identify Composer requests that succeed against restricted operations from non-administrative principals.
- Monitor for scope-change behavior where WebCenter activity is followed by actions on adjacent Fusion Middleware components.
- Alert on repeated HTTP 200 responses to Composer administrative actions initiated by accounts outside the portal administrator group.
Monitoring Recommendations
- Enable and centralize Oracle WebCenter Portal audit logging and Fusion Middleware access logs for real-time analytics.
- Baseline normal Composer usage patterns per role and flag deviations in request volume, endpoint targets, and modification actions.
- Track privilege usage across integrated Fusion Middleware components to detect the scope-change effect described in the advisory.
How to Mitigate CVE-2026-60733
Immediate Actions Required
- Apply the Oracle Critical Security Patch Update referenced in Oracle Security Alert CSPUAUG2026 to affected WebCenter Portal instances.
- Inventory all Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 deployments and prioritize internet-reachable instances for patching.
- Review and reduce accounts with low-privileged portal access to enforce least privilege until patching is complete.
Patch Information
Oracle released fixes for CVE-2026-60733 as part of the August 2026 Critical Security Patch Update. Administrators should download and deploy the WebCenter Portal patches for versions 12.2.1.4.0 and 14.1.2.0.0 directly from My Oracle Support, following the guidance in the Oracle Security Alert CSPUAUG2026.
Workarounds
- Restrict network access to WebCenter Portal Composer endpoints using web application firewall rules or reverse proxy allow-lists limited to trusted administrative networks.
- Disable or tightly scope Composer functionality for user roles that do not require content authoring until patches are applied.
- Rotate credentials for accounts with any WebCenter Portal access and require multi-factor authentication for portal logins.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
