CVE-2026-46846: Critical severity Oracle Oracle WebCenter Portal vulnerability
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. While the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict inbound HTTP/HTTPS access to Oracle WebCenter Portal: block or allow only trusted administrative IP addresses to reach the WebCenter Portal HTTP endpoints (ports 80 and 443) using network firewall rules, ACLs, or a WAF; deny all other inbound HTTP(S) traffic to the product.
- Operational
If compromise is suspected or detected, immediately isolate the affected Oracle WebCenter Portal hosts from the network, preserve forensic evidence (collect logs, disk images), rotate all application and administrative credentials and keys used by the portal, and rebuild/redeploy hosts from known-good images before returning them to service.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46846?
The severity of CVE-2026-46846 is rated as critical with a score of 10.
How do I fix CVE-2026-46846?
To fix CVE-2026-46846, apply the latest security patches provided by Oracle for affected versions.
What products are affected by CVE-2026-46846?
CVE-2026-46846 affects Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0.
What is the attack vector for CVE-2026-46846?
CVE-2026-46846 can be exploited by an unauthenticated attacker with network access via HTTP.
What are the impact categories of CVE-2026-46846?
CVE-2026-46846 can lead to a compromise of confidentiality, integrity, and availability.