CVE-2026-46796: Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites)

Synopsis

An unspecified high-severity vulnerability affects Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0), reachable over HTTP from the network by any low-privileged authenticated user. Exploitation requires a separate user to interact with attacker-controlled content, making this a social-engineering-assisted attack. Successful exploitation results in full takeover of the Oracle WebCenter Sites instance, impacting confidentiality, integrity, and availability. No fix version has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle WebCenter Sites service over the network via HTTP; there is no local or physical access requirement.

• AuthenticationRequired

  A low-privilege account is sufficient; any authenticated user can initiate the attack without needing administrator rights.

• Victim interactionRequired

  A separate, non-attacker user must interact with something (such as a crafted link or page) as part of the attack, introducing a social-engineering dependency.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is straightforward and reliable with no special race conditions or environmental prerequisites required.

Blast Radius

• Reads all data accessible to the WebCenter Sites application, including stored content, user records, and credentials.
• Modifies or destroys persisted site content, configurations, and database records managed by WebCenter Sites.
• Crashes or degrades the WebCenter Sites service, making it unavailable to legitimate users.
• Full application takeover gives the attacker a foothold to pivot further into connected Fusion Middleware components or backend systems.