External risk intelligence

Oracle WebCenter Portal Runtime Tools Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-60566

Oracle WebCenter Portal is a web-based application designed to be accessed over the network. The vulnerability is exploitable by an unauthenticated attacker via HTTP, confirming the component is intended for external-facing web service exposure.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle WebCenter Portal, a component of Oracle Fusion Middleware. This issue could allow an unauthenticated attacker, with network access, to potentially take over the portal, impacting confidentiality, integrity, and availability.

Unauthenticated attackers can compromise the portal.
Executive attention is needed for potential exposure.
Confirm relevance and assess business exposure.

Attack Path

How an attacker could exploit the issue

An attacker can target Oracle WebCenter Portal by sending network requests over HTTP. This vulnerability allows an unauthenticated attacker with network access to reach the Runtime Tools component and take control of the application.

Entry condition: Network access.
Trigger point: Runtime Tools component.
Resulting risk: Takeover of the portal.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to take over Oracle WebCenter Portal when accessed over HTTP, potentially impacting the confidentiality, integrity, and availability of the portal and any data it manages.

Oracle WebCenter Portal system.
Network access via HTTP.
Complete system takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given the critical nature and network-exploitable vector of this vulnerability in Oracle WebCenter Portal, immediate action is required. The primary responsibility for addressing this lies with the teams managing the Oracle Fusion Middleware infrastructure and the specific Oracle WebCenter Portal applications. The first practical step involves identifying all instances of the affected product, confirming their exposure to the network, assessing their business criticality, and then assigning ownership for remediation planning.

Application and infrastructure teams own it.
Verify network exposure and business criticality.
Plan and execute timely remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle WebCenter Portal?

Oracle WebCenter Portal is a core technology within Oracle Fusion Middleware used to build enterprise-grade intranets, extranets, and web portals. It acts as a centralized interface where organizations integrate content, data, and applications into a unified digital workspace. It relies on the Runtime Tools component to manage these dynamic portal interactions, making it a central point for users to access various business services and sensitive information across the enterprise.

What kind of vulnerability is CVE-2026-60566?

This is a critical security flaw that lacks a specific weakness classification but functions as an authentication bypass or injection-style issue. Essentially, it allows an attacker to interact with the Runtime Tools component in a way that was never intended. By sending malformed or unauthorized HTTP requests, an attacker can trick the system into granting them full control, effectively bypassing the security gates that should prevent unauthorized access.

How can an attacker trigger this vulnerability?

An attacker needs simple network access to reach the Oracle WebCenter Portal via HTTP. No user interaction or prior login is required, meaning the attacker does not need to have a valid account or password to start the attack. It is important to note that this bug is not triggered by internal administrative actions; it specifically targets the exposed Runtime Tools component through standard web traffic, making it reachable from any point where the portal is accessible over the network.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates that because Oracle WebCenter Portal is inherently a web-based application designed for network connectivity, it is highly likely to be exposed. If your portal instance is reachable over the network—especially if it is accessible to the public internet—the risk is high. Even internal-only deployments are at risk if an attacker has gained a foothold within your local network, as they can then reach the portal and attempt to trigger the vulnerability.

What should I do first to secure my infrastructure?

Your first step is to perform an inventory of all Oracle Fusion Middleware environments to locate every instance of the affected versions, 12.2.1.4.0 and 14.1.2.0.0. Once identified, evaluate the network accessibility of these portals to see which are exposed to untrusted networks. Engage the teams responsible for these specific applications to prioritize a remediation plan, as the critical nature of this flaw requires moving quickly to prevent unauthorized system takeover.

References

www.oracle.com/security-alerts/cpujul2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.