Description
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via RMI to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Vulnerability in the Oracle WebCenter Portal Composer component allows an attacker with low privileges who can reach the RMI interface over the network to compromise the portal. Successful exploitation results in the attacker gaining full control of the WebCenter Portal, thereby compromising confidentiality, integrity, and availability of the hosted applications and data.

Affected Systems

Affected are Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0, as specified by the advisory and the corresponding CPE entries.

Risk and Exploitability

The CVSS v3.1 base score of 8.8 indicates a high risk. The EPSS score of < 1% signals that the likelihood of exploitation is very low but not zero, and the vulnerability is not yet listed in the CISA KEV catalog, implying no widespread exploitation to date. The likely attack vector is via the public RMI service; any remote host with access to that port can attempt the exploit.

Generated by OpenCVE AI on August 21, 2026 at 18:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle patch for CVE‑2026‑60731 released in the August 2026 security advisory
  • If a patch cannot be applied immediately, block or firewall the RMI port used by WebCenter Portal to deny external network access
  • Isolate the affected WebCenter Portal instance from other network segments and monitor RMI traffic for suspicious activity

Generated by OpenCVE AI on August 21, 2026 at 18:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 19:15:00 +0000

Type Values Removed Values Added
Title Low‑Privilege RMI Exploit Enables Complete Control of Oracle WebCenter Portal

Fri, 21 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via RMI in Oracle WebCenter Portal Composer
Weaknesses CWE-502

Wed, 19 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306

Tue, 18 Aug 2026 23:15:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via RMI in Oracle WebCenter Portal Composer
Weaknesses CWE-502

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via RMI to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle webcenter Portal
CPEs cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:webcenter_portal:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle webcenter Portal
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Webcenter Portal
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-19T17:10:41.935Z

Reserved: 2026-07-08T15:51:55.584Z

Link: CVE-2026-60731

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:16:41.097

Modified: 2026-08-20T15:17:46.297

Link: CVE-2026-60731

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T19:00:13Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function