Oracle disclosed a critical vulnerability in the Composer component of Oracle WebCenter Portal that lets a low-privileged, remote attacker take over the product entirely and potentially reach beyond it into other systems.
What Is It
CVE-2026-60730 is a vulnerability in the Composer component of Oracle WebCenter Portal, part of Oracle Fusion Middleware. Oracle describes it as easily exploitable: an attacker needs only network access over HTTP and low privileges, with no user interaction required. Successful exploitation results in complete takeover of Oracle WebCenter Portal.
It carries a CVSS 3.1 base score of 9.9 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, high impact to confidentiality, integrity, and availability.
Why It Matters
The scope-changed flag (S:C) is what pushes this from severe to worst-case. Oracle notes that while the vulnerability sits in WebCenter Portal, attacks "may significantly impact additional products." On Oracle's own framing, the blast radius is not guaranteed to stop at the portal; a compromise may serve as a pivot into the surrounding Fusion Middleware footprint, and defenders should scope their response accordingly.
The low bar for exploitation compounds it. PR:L means any authenticated account, however unprivileged, is sufficient. Combined with low attack complexity and no user interaction, a single stolen or self-registered credential is enough to reach full takeover. Organizations should determine whether their own WebCenter Portal instances are reachable from untrusted networks, since network reachability is what turns that low bar into a practical entry point.
There is no CISA KEV entry for CVE-2026-60730 in the supplied data, so active exploitation is not confirmed at this time.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle WebCenter Portal (Oracle Fusion Middleware)
- Component: Composer
- Affected versions: 12.2.1.4.0 and 14.1.2.0.0
No affected CPE records were listed in the NVD data at the time of publication.
Patch Status
The CVE was published 2026-08-18 and its NVD status is Received, meaning analysis is not yet complete. The sole vendor reference is an Oracle Critical Patch Update advisory page, which is the authoritative source for fix availability and applicable patch levels for the affected 12.2.1.4.0 and 14.1.2.0.0 releases. Oracle ships Critical Patch Updates on a quarterly cycle, January, April, July and October, so administrators should confirm which scheduled CPU carries the fix rather than assuming a dedicated out-of-cycle release.
No CISA KEV entry exists for this CVE in the supplied source material, so no federal remediation deadline or required action applies.
Sources
- NVD, CVE-2026-60730: https://nvd.nist.gov/vuln/detail/CVE-2026-60730
- Oracle Critical Patch Update Advisory: https://www.oracle.com/security-alerts/cpuaug2026.html