Oracle WebCenter Sites CVE-2026-60554

No special conditions - remote unauthenticated exploitation over HTTP against supported deployments of Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0), consistent with the AV:N/AC:L/PR:N/UI:N vector and Oracle's 'easily exploitable' characterization. The practical limiting factors are that the target WebCenter Sites HTTP interface must be network-reachable by the attacker (so instances restricted to internal networks or behind VPN/WAF are far less exposed), and impact is confined to confidentiality - an attacker can read critical or all application-accessible data but cannot, through this flaw alone, modify data or disrupt availability (I:N/A:N).

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N describes an easily exploitable, network-reachable issue requiring no authentication and no user interaction, with high confidentiality impact but zero integrity or availability impact - so the practical outcome is data exposure, not takeover or disruption. Oracle's own phrasing ('easily exploitable', 'unauthenticated attacker with network access') reinforces low attack complexity. However, no EPSS score, SSVC decision data, or KEV listing was provided, and no public POC is referenced, so there is currently no evidence of automatable or active exploitation. This is a genuine priority for internet-exposed WebCenter Sites instances because unauthenticated data theft against a public web platform is attractive and low-effort, but the absence of exploitation signals suggests it is not yet under mass attack; teams should treat it as high-priority-to-patch rather than emergency-in-the-wild. Note the 'Authentication Bypass' tag and the C:H/I:N/A:N vector are consistent - an attacker reads data they should not, without modifying it.

An attacker who can reach an internet-exposed WebCenter Sites instance sends crafted HTTP requests to the affected endpoint and, exploiting the authentication bypass, retrieves content and data without logging in. Given the low attack complexity and no required user interaction, this can be scripted at scale; no public exploit code has been identified at time of analysis, so an attacker would need to develop their own.