Oracle WebCenter Portal CVE-2026-60731

Exploitation requires the attacker to hold a valid low-privileged account on the Oracle WebCenter Portal instance (PR:L per CVSS vector) and have network access to the RMI service exposed by the Composer component. Oracle WebCenter Portal must be running one of the two confirmed affected versions (12.2.1.4.0 or 14.1.2.0.0). Attack complexity is low and no user interaction is required once the RMI endpoint is reachable. The primary limiting factor is the authentication prerequisite - unauthenticated external attackers are excluded unless credential compromise occurs first. There is no indication of a non-default configuration requirement; the vulnerability appears to affect standard Composer deployments within these versions. RMI port exposure on the network perimeter would expand the practical attacker population beyond internal users.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H places this vulnerability at a high-severity tier: network-accessible, low attack complexity, requiring only low-privilege credentials, no user interaction, and resulting in full CIA compromise. Oracle's own advisory language - 'easily exploitable' - corroborates the AC:L rating and elevates operational concern. However, several risk-moderating factors apply: exploitation requires a valid low-privileged account (PR:L), meaning unauthenticated external attackers cannot directly exploit this vulnerability; no EPSS score was provided in the input data, making probability-of-exploitation estimation unavailable; and the CVE is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis. No public POC code has been identified. The real-world risk is high for organizations running these specific WebCenter Portal versions internally or exposed on enterprise networks, but the authenticated prerequisite meaningfully limits the attack surface relative to a PR:N vulnerability. This should be treated as a genuine priority for Oracle Fusion Middleware environments, particularly given Oracle's infrequent patch cadence (quarterly CPUs).

An attacker with a valid low-privileged account in an Oracle WebCenter Portal deployment connects over the network to the RMI endpoint exposed by the Composer component and submits a crafted RMI payload. The malicious invocation exploits the vulnerability in Composer to gain unauthorized control of the portal instance, potentially leading to full system takeover including data exfiltration, content manipulation, and service disruption. No public POC has been identified, but the 'easily exploitable' characterization from Oracle suggests low technical barrier once an attacker has valid credentials.