CVE-2026-46844: Critical severity Oracle Oracle WebCenter Portal vulnerability
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle WebCenter Portal. While the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to the Oracle WebCenter Portal HTTPS interface to only trusted IPs/networks using firewall rules or network ACLs; block or limit public Internet access and place the application in a segmented, private network.
- Compensating control
Place a Web Application Firewall (WAF) or intrusion prevention system (IPS) in front of the Oracle WebCenter Portal HTTPS endpoint to detect and block exploitation attempts against the vulnerability.
- Operational
Treat affected instances as potentially compromised: review logs and indicators of compromise, revoke active sessions and credentials as appropriate, rotate administrative credentials and API keys, and rebuild/redeploy systems if compromise is confirmed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46844?
CVE-2026-46844 has a critical severity score of 9.9.
How do I fix CVE-2026-46844?
To fix CVE-2026-46844, upgrade to a non-affected version of Oracle WebCenter Portal.
What versions are affected by CVE-2026-46844?
CVE-2026-46844 affects Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0.
Who can exploit CVE-2026-46844?
CVE-2026-46844 can be easily exploited by low privileged attackers with network access via HTTPS.
What component of Oracle is affected by CVE-2026-46844?
CVE-2026-46844 affects the Security Framework component of Oracle WebCenter Portal.