Oracle WebCenter Portal CVE-2026-60565

The attacker must hold a valid low-privilege account on Oracle WebCenter Portal (PR:L) and must be able to reach the portal's HTTP interface over the network (AV:N); exploitation targets the Runtime Tools component. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once authenticated, exploitation is straightforward against affected versions 12.2.1.4.0 and 14.1.2.0.0. The primary limiting factor is the authentication requirement - an attacker needs credentials or a way to obtain a low-privilege account (self-registration, phishing, or credential reuse) - so instances that are not internet-facing or that strictly control account issuance present a smaller attack surface. Exposure is greatest for portals reachable from untrusted networks that allow low-privilege account creation.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 9.9) describes a near-worst-case network-exploitable flaw: no user interaction, low complexity, only low privileges required, full confidentiality/integrity/availability impact, and a scope change amplifying blast radius. Oracle explicitly labels it 'easily exploitable,' which aligns with AC:L/PR:L. However, several corroborating signals are absent: no EPSS score, no CWE, no KEV listing, and no POC are present in the provided intelligence, so real-world exploitation probability cannot be quantified from the data - the 9.9 reflects potential impact, not observed activity. The one qualifier that lowers practicality is PR:L: the attacker must already hold a valid low-privilege account on the portal, so exposure is materially higher for internet-facing instances that permit self-registration or have weak credential hygiene than for tightly access-controlled internal deployments. Treat this as a high-priority patch given the trivial exploitation profile and takeover impact, while noting that active exploitation is not confirmed.

An attacker who has obtained or registered a low-privilege WebCenter Portal account sends a crafted HTTP request to the Runtime Tools component over the network, requiring no user interaction and low effort. Because of the scope change, the request escalates beyond the portal to take over the WebCenter Portal instance and potentially impact co-located Fusion Middleware components, yielding full confidentiality, integrity, and availability loss. No public exploit code is identified at time of analysis, so this reflects the vector's potential rather than an observed campaign.