CVE-2026-46845: Critical severity Oracle Oracle WebCenter Portal vulnerability
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to Oracle WebCenter Portal HTTPS endpoints to only trusted IPs/networks using firewall rules or network ACLs (block public Internet access where possible).
- Compensating control
Deploy or enable a Web Application Firewall (WAF) or intrusion prevention system in front of Oracle WebCenter Portal to detect and block exploit attempts over HTTPS.
- Compensating control
Isolate Oracle WebCenter Portal instances from untrusted networks (remove from Internet-facing exposure) until a vendor-supplied fix is available.
- Operational
Monitor and review access and application logs for signs of exploitation; if compromise is suspected, isolate affected systems, perform incident response actions (containment/forensic analysis), restore from known-good backups, and rotate credentials and secrets used by the portal.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46845?
CVE-2026-46845 has a critical severity rating of 9.8.
How do I fix CVE-2026-46845?
To fix CVE-2026-46845, update your Oracle WebCenter Portal to a supported version that addresses this vulnerability.
Who is affected by CVE-2026-46845?
CVE-2026-46845 affects users of Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0.
What type of access does an attacker need for CVE-2026-46845?
An attacker requires unauthenticated network access via HTTPS to exploit CVE-2026-46845.
What components of Oracle Fusion Middleware are impacted by CVE-2026-46845?
CVE-2026-46845 impacts the Security Framework component of the Oracle WebCenter Portal product.