CVE-2026-46801: Critical severity Oracle WebCenter Sites vulnerability
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable direct HTTP access to Oracle WebCenter Sites where possible. If HTTP cannot be fully disabled, restrict access to the HTTP/application ports to internal/trusted networks or require access via VPN.
Oracle WebCenter Sites HTTP access = disabled or restricted to trusted networks - Compensating control
Place Oracle WebCenter Sites behind a web application firewall (WAF) and/or perimeter firewall and block or restrict HTTP access from the public Internet. Apply access control lists to allow only trusted IP ranges to reach the application.
- Compensating control
Segment the Oracle WebCenter Sites hosts from general user networks and restrict inbound network access to the minimum required (microsegmentation/host-based firewall).
- Operational
If compromise is suspected or after applying mitigations, perform incident response actions: review and retain logs for signs of exploitation, conduct forensic analysis, and rotate all credentials, API keys, and secrets used by Oracle WebCenter Sites.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46801?
CVE-2026-46801 has a critical severity score of 9.8.
How do I fix CVE-2026-46801?
To fix CVE-2026-46801, update Oracle WebCenter Sites to a version that is not affected by this vulnerability.
Who can exploit CVE-2026-46801?
CVE-2026-46801 can be exploited by an unauthenticated attacker with network access via HTTP.
What components are affected by CVE-2026-46801?
The components affected by CVE-2026-46801 are the Oracle WebCenter Sites within Oracle Fusion Middleware.
Which versions of Oracle WebCenter Sites are impacted by CVE-2026-46801?
The supported versions affected by CVE-2026-46801 are 12.2.1.4.0 and 14.1.2.0.0.