CVE-2026-60730 is a vulnerability in Oracle WebCenter Portal's Composer component that allows a low privileged attacker with network access via HTTP to fully compromise the portal. The vulnerability affects Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle’s August 2026 Critical Security Patch Update advisory includes this vulnerability among 943 security patches and strongly recommends applying patches promptly. The advisory does not explicitly state patch availability for these exact versions but implies that patches exist within the update cycle.

Successful exploitation of this vulnerability can result in complete takeover of Oracle WebCenter Portal, compromising confidentiality, integrity, and availability of the affected system. Additionally, the attack may significantly impact other Oracle products due to scope change. The CVSS score of 9.9 reflects the critical nature of this vulnerability.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among many others. Customers are strongly advised to apply the relevant patches from this update without delay. The vendor advisory does not indicate that no action is required or that the issue is already mitigated; therefore, patching is the recommended remediation. Check Oracle’s official advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for detailed patch availability and installation instructions.