CVE-2026-46799: Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites)

Synopsis

A critical unauthenticated remote takeover vulnerability exists in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0), a component of Oracle Fusion Middleware. The vulnerability is reachable over HTTP from any network location and requires no credentials or user interaction. Successful exploitation gives an attacker full control over the affected WebCenter Sites instance, including complete read, write, and denial-of-service capability. No fix versions have been published by Oracle; HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WebCenter Sites HTTP service over a network; the vulnerability is exposed to any host with network access to the target.

• AuthenticationNot required

  No credentials of any kind are needed; the attack can be launched by a completely unauthenticated external party.

• Victim interactionNot required

  Exploitation is entirely server-side and requires no action from any user or administrator of the affected system.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental prerequisites.

Blast Radius

• A successful attacker reads all content, configuration data, stored credentials, and session tokens held by the WebCenter Sites application.
• The attacker writes or modifies any persisted content, site configuration, or user data managed by the platform.
• The attacker can crash or permanently disable the WebCenter Sites service, taking it offline for all users.
• Full system takeover means the attacker can pivot from the compromised instance to other services reachable from within the same container or host network.