CVE-2026-60731

The EPSS score of 0.00479 will mislead you toward under-prioritizing this CVE. Don't let it. That score reflects external exposure probability—WebCenter Portal deploys internally behind enterprise perimeters where commodity scanners don't look. The real risk lives in your internal network topology, not in external telemetry. Oracle's advisory flags this as 'easily exploitable' with a CVSS 8.8. In Oracle's taxonomy, that language signals a direct attack path without chained vulnerabilities. More critically, the 'low-privileged' qualifier means any authenticated user—potentially any user with valid credentials on the same internal segment—can reach the exploitable Composer endpoint. In environments where phishing, credential stuffing, or supply chain compromise provides initial access, this effectively becomes a universal exploitation path. The RMI attack surface is the mechanism that matters here. Oracle middleware has a documented history of RMI deserialization vulnerabilities, and the Composer component handles construction and rendering of portal content—meaning untrusted data flows through deserialization endpoints. RMI is also notoriously unmonitored in most enterprises; standard IDS deployments don't inspect JVM traffic on non-HTTP ports, and network vulnerability scanners often exclude RMI ports from coverage. The version regression is the most alarming detail: 14.1.2.0.0 (the newer release) is also affected alongside 12.2.1.4.0. Either Oracle failed to properly backport the fix, or new Composer functionality re-introduced the vulnerable deserialization pattern. Either scenario suggests this is an architectural flaw in how the product handles deserialization, not a single implementation error. Your actions: First, verify whether Composer component access controls genuinely restrict low-privileged users from invoking vulnerable RMI methods—assume they don't without evidence. Second, map all RMI-exposed ports in your Oracle middleware stack; this CVE likely isn't isolated. Third, treat the patch as symptomatic rather than curative—demand Oracle's root-cause analysis and audit adjacent Fusion Middleware components for similar patterns. Fourth, confirm your monitoring coverage extends to RMI/JMX ports; if it doesn't, you won't detect exploitation attempts.

Reviewed through automated stages and approved by a human before publication.