Oracle WebCenter Sites CVE-2026-60552

Exploitation requires network access to the Oracle WebCenter Sites HTTP interface and a low-privileged authenticated account (CVSS PR:L), but no user interaction (UI:N) and low attack complexity (AC:L). The affected deployments must be running supported versions 12.2.1.4.0 or 14.1.2.0.0. The key limiting factor is the PR:L prerequisite: a purely anonymous/unauthenticated attacker cannot exploit this without first obtaining some valid low-level access, so environments that tightly control account provisioning and restrict who can reach the application over HTTP materially reduce realistic risk. The scope change (S:C) means a successful attacker's impact is not confined to WebCenter Sites itself.

The signals are strong and internally consistent for a high-priority issue: CVSS 3.1 9.9 with AV:N/AC:L/PR:L/UI:N means network-reachable, low-complexity exploitation requiring only a low-privileged account and no user interaction, and S:C/C:H/I:H/A:H means total compromise plus cross-product impact. Oracle explicitly calls it 'easily exploitable,' reinforcing the low-complexity rating. Counterbalancing this, no EPSS score, no SSVC decision data, and no KEV listing were provided, and no public exploit has been identified - so widespread active exploitation is not evidenced, and the primary real-world limiter is the PR:L requirement (an attacker needs some valid, low-level access to the application). Given Oracle Fusion Middleware products are frequent targets and CPU flaws are often reverse-engineered from patches, the absence of a public PoC should be treated as a timing gap rather than reassurance. No conflicting data was found in the input; the main missing signals are EPSS and any independent exploit intelligence.

An attacker who holds or obtains a low-privileged WebCenter Sites account (for example, a limited content contributor or a compromised low-level credential) sends crafted HTTP requests to the application over the network, requiring no user interaction. By abusing the flawed component, the attacker escalates to full control of WebCenter Sites and, due to the scope change, pivots to impact additional Fusion Middleware products. No public exploit is identified at time of analysis, but Oracle characterizes the attack as easily exploitable.