CVE-2026-60551

CriticalCVSS 9.8

Published: 21/07/2026(UTC)Updated: 01/08/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

38th percentile - higher than 38% of all known CVEs

Summary

Vulnerability in Oracle WebCenter Sites allows an unauthenticated attacker to remotely take over the system via HTTP. It requires only network access and no privileges or user interaction.

Risk Assessment

An attacker can gain full control of the WebCenter Sites server, leading to loss of confidentiality, integrity, and availability of data.

Recommendation

Immediately apply the security patch provided by Oracle for versions 12.2.1.4.0 and 14.1.2.0.0.

Original NVD description (English source)

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).