CVE-2026-46803: Critical severity Oracle Oracle WebCenter Portal vulnerability
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. While the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable or stop HTTP (unencrypted/public) access to Oracle WebCenter Portal until an official vendor fix is applied; if disabling is not possible, restrict HTTP listeners to localhost or management network only.
Oracle WebCenter Portal HTTP access = disabled - Compensating control
Restrict access to Oracle WebCenter Portal HTTP endpoints to only trusted IPs via perimeter firewall, WAF, or ACLs; block direct Internet access to the service.
- Compensating control
Segment and isolate Oracle WebCenter Portal instances from other products and sensitive networks to limit scope of potential compromise.
- Operational
If compromise is suspected (takeover is possible), immediately isolate affected systems, rotate all credentials and API keys used by or stored in the portal, and rebuild/recover instances from known-good backups; monitor logs and network traffic for signs of exploitation.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46803?
The severity of CVE-2026-46803 is critical with a score of 10.
How do I fix CVE-2026-46803?
To fix CVE-2026-46803, upgrade to the latest patched version of Oracle WebCenter Portal available for your system.
What components are affected by CVE-2026-46803?
CVE-2026-46803 affects the Security Framework component of the Oracle WebCenter Portal product.
Who can exploit CVE-2026-46803?
CVE-2026-46803 can be exploited by an unauthenticated attacker with network access via HTTP.
Which versions of Oracle WebCenter Portal are vulnerable to CVE-2026-46803?
The affected versions of Oracle WebCenter Portal are 12.2.1.4.0 and 14.1.2.0.0.