CVE-2026-46798: Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites)

Synopsis

A critical remote code execution class vulnerability affects Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0), a component of Oracle Fusion Middleware. The flaw is reachable over the network via HTTP with no authentication required and no user interaction needed, making it trivially exploitable by any attacker who can reach the service. Successful exploitation gives an attacker full takeover of the WebCenter Sites instance, with impacts extending beyond the directly affected product to other systems in scope. HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment Oracle publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle WebCenter Sites service over the network via HTTP; no local or physical access is needed.

• AuthenticationNot required

  No account or credentials of any privilege level are required to exploit this vulnerability.

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from any user of the affected system.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental prerequisites.

Blast Radius

• A successful attacker reads all data stored in the WebCenter Sites instance, including content, configuration, and any credentials held in application storage.
• A successful attacker modifies or deletes persisted content, configuration, and application data within WebCenter Sites.
• A successful attacker crashes or renders the WebCenter Sites service unavailable, disrupting content delivery.
• Because the CVSS scope is changed, a successful attacker pivots from WebCenter Sites to compromise additional products or services running in the same environment.