CVE-2026-46765: Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer)

Synopsis

A critical-severity vulnerability in the Composer component of Oracle WebCenter Portal (versions 12.2.1.4.0 and 14.1.2.0.0) allows a network-accessible attacker holding any low-privilege account to fully compromise the portal. Exploitation requires no victim interaction and no elevated permissions, making it straightforward to trigger over standard HTTP. Successful exploitation gives the attacker complete control over confidentiality, integrity, and availability of the portal, with scope change meaning the blast extends to additional products in the same environment. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Oracle WebCenter Portal service over the network via HTTP; there is no requirement for local or physical access.

• AuthenticationRequired

  Any low-privilege account on the portal is sufficient; no administrative or elevated credentials are needed.

• Victim interactionNot required

  The attack completes without any action from another user or administrator on the target system.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental prerequisites.

Blast Radius

• Attacker reads all data stored in Oracle WebCenter Portal, including user session tokens, portal content, and any integrated data sources exposed through the Composer component.
• Attacker modifies or destroys portal content, configurations, and persisted user data, corrupting the integrity of the WebCenter environment.
• Attacker crashes or renders the portal service unavailable, causing a full denial of service for all portal users.
• Due to scope change, attacker pivots to compromise additional Oracle Fusion Middleware products sharing the same runtime environment.