External risk intelligence

Oracle WebCenter Sites Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-60555

Oracle WebCenter Sites is a web-based content management system typically deployed as a web application or portal. Given that it serves web content and interacts via HTTP, it is commonly exposed to the network or the public internet to fulfill its functional role as a web-accessible enterprise platform.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle WebCenter Sites, a component of Oracle Fusion Middleware. This issue is easily exploitable by an unauthenticated attacker over the network, potentially leading to a complete takeover of the affected system, with significant impacts on confidentiality, integrity, and availability. The primary concern for leadership is to confirm if this specific Oracle product is in use within the organization and, if so, to understand the potential exposure.

Unauthenticated attackers can fully control the system.
A takeover means full system compromise.
Confirm Oracle WebCenter Sites usage and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can compromise Oracle WebCenter Sites by sending specially crafted requests over the network. This vulnerability allows an unauthenticated attacker to gain complete control of the affected system, leading to unauthorized access, modification, or destruction of data.

No authentication required.
Network access via HTTP.
Complete takeover of the system.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to take over Oracle WebCenter Sites when it's accessible via HTTP. This could impact the confidentiality, integrity, and availability of the affected system.

System data and service behavior at risk.
Attacker could exploit network access.
Complete takeover of the system.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Oracle WebCenter Sites, likely managed by an application or platform team responsible for web content delivery. The first step is to identify all instances of this product, determine their network exposure and business criticality, and pinpoint the accountable owner before planning remediation.

Application or platform teams own the issue.
Verify network exposure and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle WebCenter Sites?

Oracle WebCenter Sites is a web-based content management system within Oracle Fusion Middleware. It provides tools for organizations to build and manage large-scale web portals and deliver digital content. Because it functions as a web-accessible enterprise platform, it is typically deployed as a web application that interacts directly with users or other systems via HTTP.

What does this CVE-2026-60555 vulnerability mean?

This vulnerability represents a critical security weakness that allows an unauthenticated attacker to take full control of the WebCenter Sites platform. In technical terms, it enables complete system compromise, meaning an attacker can access, modify, or destroy data and disrupt services. It effectively bypasses standard security barriers, granting unauthorized users the same capabilities as an administrator.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by sending specially crafted HTTP requests to the target system over the network. Because the vulnerability does not require authentication, the attacker does not need a user account or login credentials to initiate the attack. Interactions that do not involve sending network traffic over HTTP, such as local system processes or non-networked commands, do not trigger this specific issue.

How relevant is this to my network security?

If you host this software, it is highly relevant. Halo Surface Signal identifies this as an external risk because WebCenter Sites is typically deployed to be web-accessible. If your instance is reachable via the internet or sits on a broad internal network, it is a primary target. Even if the system is internal, any attacker with network access to the server can attempt to exploit this without needing to prove who they are.

What should I do if I run this software?

Your immediate priority is to locate all instances of Oracle WebCenter Sites within your environment. Once identified, verify which systems are running versions 12.2.1.4.0 or 14.1.2.0.0 and determine their specific network exposure and business criticality. Engage the platform or application team responsible for these servers to verify the current configuration and prepare for authorized remediation steps.

References

www.oracle.com/security-alerts/cpujul2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.