CVE-2026-46802: Critical severity Oracle Oracle WebCenter Portal vulnerability
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. While the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Oracle WebCenter Portalfrom your environment.If Oracle WebCenter Portal is not required in your environment, uninstall or disable the product to eliminate the attack surface.
- Compensating control
Restrict network access to Oracle WebCenter Portal HTTP endpoints to trusted IPs only (firewall/ACL) and/or place the service behind a reverse proxy so only necessary clients can reach it.
- Compensating control
Deploy a web application firewall (WAF) or intrusion prevention system to detect and block attempts to exploit HTTP-accessible vulnerabilities against Oracle WebCenter Portal.
- Operational
Monitor Portal and web server logs for suspicious activity, investigate potential compromises, and if compromise is suspected rotate any credentials, API keys, and secrets that may have been exposed. Apply vendor-supplied patches or updates as soon as they become available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46802?
CVE-2026-46802 has a critical severity rating of 9.9.
How does CVE-2026-46802 affect Oracle WebCenter Portal?
CVE-2026-46802 allows a low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal.
Which versions of Oracle WebCenter Portal are affected by CVE-2026-46802?
The affected versions of Oracle WebCenter Portal for CVE-2026-46802 are 12.2.1.4.0 and 14.1.2.0.0.
How do I mitigate the risks associated with CVE-2026-46802?
To mitigate CVE-2026-46802, it is recommended to update to a fixed version of Oracle WebCenter Portal.
What type of vulnerability is CVE-2026-46802 categorized as?
CVE-2026-46802 is categorized as an easily exploitable vulnerability in the Security Framework of Oracle WebCenter Portal.