Oracle WebCenter Sites CVE-2026-60558

Exploitation requires network access to the Oracle WebCenter Sites HTTP interface and no authentication (PR:N), so an exposed instance is directly reachable by unauthenticated remote attackers. The primary limiting factor is high attack complexity (AC:H): Oracle explicitly describes it as 'difficult to exploit,' meaning success depends on conditions outside the attacker's control - likely specific server state, timing, or a required multi-step precondition - rather than a single deterministic request. No user interaction is needed (UI:N) and scope is unchanged (S:U). Realistic risk is therefore concentrated on internet-exposed or broadly network-accessible WebCenter Sites deployments running 12.2.1.4.0 or 14.1.2.0.0; instances restricted to trusted internal networks are materially harder to reach.

The CVSS 3.1 base score is 8.1 (High) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - network-reachable and unauthenticated (PR:N), but with high attack complexity (AC:H), which is the key limiting factor. The AC:H metric signals that exploitation depends on conditions outside the attacker's control (timing, specific state, or a non-trivial multi-step precondition), so this is not a point-and-click mass-exploitation candidate despite the 'takeover' outcome. No EPSS score, no SSVC decision data, no KEV entry, and no POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Note a signal conflict worth flagging: Oracle's tag says 'Information Disclosure,' but the CVSS vector asserts full C/I/A takeover - treat the CVSS/description 'takeover' framing as authoritative and the tag as incomplete. Net: a genuine High-severity issue meriting prompt patching, but the AC:H and absence of exploit signals place it below wormable/KEV-grade emergencies.

An attacker who can reach the WebCenter Sites HTTP interface sends a crafted request sequence that exploits the flaw to gain control of the application without any credentials, ultimately achieving full takeover of the WebCenter Sites instance and its content. Because the CVSS vector is AC:H, the attacker must satisfy a non-trivial precondition (such as specific server state or timing) rather than a single trivial request; no public proof-of-concept was identified at time of analysis.