PatchSiren cyber security CVE debrief

CVE-2026-60551 Oracle Corporation CVE debrief

A critical vulnerability was identified in Oracle WebCenter Sites, a component of Oracle Fusion Middleware. The vulnerability has been assigned a CVSS 3.1 Base Score of 9.8, indicating a high severity level. The vulnerability affects supported versions 12.2.1.4.0 and 14.1.2.0.0. This vulnerability allows unauthenticated attackers with network access via HTTP to compromise Oracle WebCenter Sites, potentially leading to a takeover of the site. Organizations should prioritize patching this vulnerability to prevent potential takeovers. The CVE record was published on 2026-07-21T22:17:55.070Z and was last modified on 2026-07-27T13:18:23.077Z.

Vendor: Oracle Corporation
Product: Oracle WebCenter Sites
CVSS: CRITICAL 9.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-07-21
Original CVE updated: 2026-07-27
Advisory published: 2026-07-21
Advisory updated: 2026-07-27

Who should care

Organizations using Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 should prioritize patching this vulnerability to prevent potential takeovers. Security teams and administrators responsible for Oracle WebCenter Sites deployments should review the official advisory and take immediate action to protect their systems.

Technical summary

The vulnerability in Oracle WebCenter Sites allows unauthenticated attackers with network access via HTTP to compromise the site. Successful attacks can result in the takeover of Oracle WebCenter Sites. The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability has a high CVSS score of 9.8, indicating a critical severity level. The affected versions of Oracle WebCenter Sites are 12.2.1.4.0 and 14.1.2.0.0.

Defensive priority

High

Recommended defensive actions

Apply the latest security patches for Oracle WebCenter Sites
Restrict network access to Oracle WebCenter Sites
Monitor for suspicious activity
Implement compensating controls
Inventory and verify affected systems
Review and update incident response plans
Conduct a thorough risk assessment for Oracle WebCenter Sites deployments

Evidence notes

The CVE record was published on 2026-07-21T22:17:55.070Z and was last modified on 2026-07-27T13:18:23.077Z. The NVD entry is currently Undergoing Analysis. The vulnerability has a high CVSS score of 9.8, indicating a critical severity level. The affected versions of Oracle WebCenter Sites are 12.2.1.4.0 and 14.1.2.0.0. Defenders should verify the affected scope, severity, and vendor guidance.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:17:55.070Z and has not been modified since then. The NVD entry is currently Undergoing Analysis.