CVE-2026-46797: Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites)

Synopsis

A critical unauthenticated remote compromise vulnerability affects Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0), a component of Oracle Fusion Middleware. The flaw is reachable over the network via HTTP and requires no credentials or user interaction to trigger. Successful exploitation gives an attacker full control over the WebCenter Sites instance, including complete read, write, and availability impact. No fix versions have been published yet; HarborGuard tracks this advisory and will surface a patched-image rebuild the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WebCenter Sites service over the network via HTTP; there is no requirement for local or physical access.

• AuthenticationNot required

  No credentials of any privilege level are needed; the vulnerability is exploitable by any unauthenticated network-accessible party.

• Victim interactionNot required

  No user or administrator action is required to trigger the vulnerability; the attacker operates entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other variable environmental factors.

Blast Radius

• A successful attacker reads all data stored by the WebCenter Sites application, including content, configuration, and any credentials or session material held in the service.
• The attacker can modify or delete persisted content, site configuration, and backend data, enabling defacement or sabotage of managed web properties.
• The attacker can crash or render the WebCenter Sites service fully unavailable, disrupting content delivery for any sites the instance manages.
• Full system takeover means the attacker can pivot from the WebCenter Sites host to adjacent internal services reachable from that network position.