CVE-2026-46767: Critical severity Oracle Oracle WebCenter Portal vulnerability
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. While the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to Oracle WebCenter Portal (Composer) HTTP interfaces to trusted management IPs using firewall rules or network ACLs. Place the service behind a WAF or reverse proxy to filter and block malicious HTTP requests.
- Operational
Monitor Oracle security advisories for Oracle WebCenter Portal/Composer and apply any vendor-provided security updates or patches as soon as they are released.
- Operational
If compromise is suspected or confirmed, perform incident response: isolate the affected system(s), preserve logs, and rotate any credentials or keys that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46767?
The severity of CVE-2026-46767 is critical with a score of 9.9.
How do I fix CVE-2026-46767?
To fix CVE-2026-46767, you should apply the latest security patches provided by Oracle for the affected versions.
What systems are affected by CVE-2026-46767?
CVE-2026-46767 affects Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0.
What types of vulnerabilities does CVE-2026-46767 represent?
CVE-2026-46767 represents an easily exploitable vulnerability allowing low privileged attackers network access to compromise the Oracle WebCenter Portal.
What are the consequences of exploiting CVE-2026-46767?
Exploiting CVE-2026-46767 can lead to complete system compromise, including unauthorized access to confidential information.