Oracle WebCenter Portal CVE-2026-60568

Exploitation requires network HTTP access to the Oracle WebCenter Portal Runtime Tools component and a low-privileged authenticated account (CVSS PR:L), but no user interaction and no elevated privileges. Limiting factors: the attacker must first hold valid low-level credentials, so deployments that disable self-registration and restrict portal reachability materially raise the bar; only versions 12.2.1.4.0 and 14.1.2.0.0 are stated as affected. The scope change (S:C) means a successful attack is not confined to the portal and can affect additional integrated Fusion Middleware products.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H yields a 9.9 base score: network-reachable, low complexity, only low privileges needed, no user interaction, and a scope change with total impact - Oracle explicitly calls it 'easily exploitable' and warns attacks 'may significantly impact additional products.' The realistic risk is high because the only meaningful barrier is possession of low-level (any authenticated) credentials, which are common in portal deployments with self-registration or broad internal user bases. No EPSS score was provided, so exploitation probability cannot be quantified; the vulnerability is not in CISA KEV and no POC is referenced, so this is currently a critical-severity, not-yet-confirmed-exploited issue. Note a signal conflict: the Oracle tag labels this 'Information Disclosure,' yet the description and vector describe full takeover with integrity and availability impact - treat the takeover framing as authoritative and the tag as an incomplete label.

An attacker who holds or obtains a low-privileged WebCenter Portal account (for example via self-registration or a phished internal credential) sends crafted HTTP requests to the Runtime Tools component and escalates to full control of the portal. Given the scope change, the attacker then pivots to the underlying WebLogic/Fusion Middleware layer and adjacent products to read sensitive data, alter content, or disrupt service. No public exploit is identified at this time, and low attack complexity means a reliable exploit would require little sophistication once the mechanism is known.