Oracle WebCenter Sites CVE-2026-60553

Exploitation requires network reachability to the Oracle WebCenter Sites HTTP interface (versions 12.2.1.4.0 or 14.1.2.0.0) with no authentication and no user interaction (PR:N/UI:N). However, the CVSS AC:H rating means a non-trivial condition outside the attacker's control must be met for success - Oracle does not specify it in the description, but AC:H typically implies a required race/timing window, a specific server state, or a particular configuration; the vendor's 'Authentication Bypass' tag identifies the primitive but not the precondition. Limiting factors that reduce realistic risk: instances not exposed to untrusted networks are not remotely reachable, the high attack complexity impedes reliable or automated mass exploitation, and only the two named supported versions are stated as affected. Verify the exact precondition with Oracle before rating exposure.

Signals are mixed and warrant careful prioritization. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) describes a network-reachable, unauthenticated attack with no user interaction but explicitly HIGH attack complexity (AC:H), meaning successful exploitation depends on conditions outside the attacker's control (e.g., timing, specific configuration, or a non-trivial precondition). This complexity is what holds the score at 8.7 rather than critical. No EPSS score, SSVC decision, KEV entry, or POC was provided, so real-world exploitation likelihood cannot be quantified from the input - the absence of these signals is not evidence of low risk, only of missing telemetry. The high confidentiality and integrity impact against a full CMS, plus the scope change, makes this a genuine priority for exposed instances, tempered by the AC:H barrier that likely limits opportunistic mass exploitation. Note the conflict worth verifying: the vendor tags this 'Authentication Bypass' (implying a reliable primitive) yet rates AC:H (implying difficulty) - confirm the precise precondition with Oracle.

An attacker who can reach an internet-exposed WebCenter Sites instance over HTTP sends crafted requests that bypass authentication to invoke content-management operations, then exfiltrates or tampers with all CMS-accessible data - defacing published content or planting malicious material. Because the attack has high complexity, the attacker likely needs to satisfy a specific precondition or timing window rather than firing a single reliable request. No public POC was identified at time of analysis.