CVE-2026-46800: Critical severity Oracle WebCenter Sites vulnerability
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. While the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable or block public/untrusted HTTP access to Oracle WebCenter Sites. Only allow access from trusted IP ranges or through an approved reverse proxy/WAF. If HTTP cannot be fully disabled, restrict it via firewall/ACLs to management/administrative networks.
Oracle WebCenter Sites HTTP access = disabled or restricted to trusted sources - Compensating control
Place Oracle WebCenter Sites behind a web application firewall (WAF) and/or apply network segmentation to isolate it from other products and internal networks to reduce scope and prevent lateral movement. Block direct external HTTP access at network perimeter devices.
- Operational
Assume potential compromise due to the possibility of takeover: isolate affected systems, perform forensic investigation, and rotate any credentials, API keys, and secrets that could have been exposed prior to applying fixes or additional mitigations.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46800?
CVE-2026-46800 has a critical severity rating of 10.
How can I fix CVE-2026-46800?
To fix CVE-2026-46800, upgrade to a supported version of Oracle WebCenter Sites that is not affected by the vulnerability.
What components are affected by CVE-2026-46800?
CVE-2026-46800 affects the WebCenter Sites component of Oracle Fusion Middleware.
Is it possible to exploit CVE-2026-46800 remotely?
Yes, CVE-2026-46800 is easily exploitable by an unauthenticated attacker with network access via HTTP.
Which versions of Oracle WebCenter Sites are vulnerable to CVE-2026-46800?
The vulnerable versions of Oracle WebCenter Sites are 12.2.1.4.0 and 14.1.2.0.0.