Oracle WebCenter Portal CVE-2026-60561

Exploitation requires network access to the Oracle WebCenter Portal HTTP interface and a low-privileged authenticated account on the portal (CVSS PR:L) - it is not fully unauthenticated. The specific attack surface is the 'Runtime Tools' component of WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so any valid low-privilege user who can reach the portal over HTTP meets the bar. Limiting factors: the attacker must possess or obtain valid low-tier credentials, the instance must be one of the two named affected versions, and the HTTP endpoint must be network-reachable; environments that restrict portal access to trusted networks or minimize low-privilege account issuance materially reduce exposure.

The signals are strong but partly one-sided. CVSS 3.1 is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H): network vector, low complexity, only low privileges required, no user interaction, scope change, and full CIA impact - an unusually severe combination that Oracle itself describes as 'easily exploitable.' Against that, there is no EPSS score provided, no CISA KEV listing, and no evidence of a public proof-of-concept, so exploitation is currently theoretical rather than observed. The one apparent tension is Oracle's 'Information Disclosure' tag versus the assessed full integrity/availability impact and 'takeover' language - verify against the Oracle advisory, as the tag likely understates the true impact. Net: treat as a genuine high priority driven by the low bar to exploit (PR:L, AC:L, no UI) and full-takeover impact, not merely a high number, while noting active exploitation is not confirmed.

A user who has obtained any low-privilege WebCenter Portal account (for example, a basic authenticated portal user or a compromised low-tier credential) sends crafted HTTP requests to the Runtime Tools component and abuses the authorization weakness to escalate to full control of the portal. Given the scope change, the attacker then pivots to affect other co-located Fusion Middleware resources, achieving confidentiality, integrity, and availability compromise. No public proof-of-concept is known at time of analysis, but the low attack complexity means a working exploit would require minimal sophistication once details are known.