CVE-2026-46838: Critical severity Oracle Oracle WebCenter Portal vulnerability
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle WebCenter Portal. While the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to Oracle WebCenter Portal's HTTPS interface to trusted IP addresses or trusted networks using firewall rules or network ACLs. If public HTTPS access is required, place a web application firewall (WAF) in front of the portal and implement rules to block or inspect exploit attempts against the Security Framework.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46838?
The severity of CVE-2026-46838 is rated as critical with a score of 9.9.
How do I fix CVE-2026-46838?
To fix CVE-2026-46838, upgrade to the patched versions of Oracle WebCenter Portal as specified in the security advisory.
What is the impact of CVE-2026-46838?
CVE-2026-46838 allows an attacker with low privileges to compromise Oracle WebCenter Portal, potentially leading to unauthorized access to sensitive information.
Which versions are affected by CVE-2026-46838?
The affected versions for CVE-2026-46838 are Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0.
Can CVE-2026-46838 be exploited remotely?
Yes, CVE-2026-46838 is easily exploitable by an attacker with network access via HTTPS.