CVE-2026-46798: Critical severity Oracle Oracle WebCenter Sites vulnerability
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. While the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to Oracle WebCenter Sites HTTP endpoints to only trusted IPs using firewall rules or network ACLs; block all other external HTTP access.
- Compensating control
Deploy a web application firewall (WAF) or HTTP filtering appliance in front of Oracle WebCenter Sites to detect and block exploit attempts targeting HTTP interfaces.
- Compensating control
Isolate Oracle WebCenter Sites instances from the public Internet and untrusted networks (place behind VPN or internal network segments) until a vendor fix can be applied.
- Operational
Monitor vendor (Oracle) security advisories for WebCenter Sites and apply any official patches or updates as soon as they are released.
- Operational
If compromise is suspected, perform incident response actions: take affected systems offline or isolate them, review logs for indicators of compromise, and rotate any credentials or keys that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46798?
CVE-2026-46798 has a severity rating of critical with a score of 10.
What types of attacks can exploit CVE-2026-46798?
CVE-2026-46798 can be exploited by unauthenticated attackers with network access via HTTP.
Which versions of Oracle WebCenter Sites are affected by CVE-2026-46798?
The affected versions of Oracle WebCenter Sites are 12.2.1.4.0 and 14.1.2.0.0.
How do I fix CVE-2026-46798?
To remediate CVE-2026-46798, it is recommended to upgrade to a patched version of Oracle WebCenter Sites.
What component is primarily affected by CVE-2026-46798?
CVE-2026-46798 primarily affects the WebCenter Sites component of Oracle Fusion Middleware.