CVE-2026-46800: Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites)

Synopsis

A critical unauthenticated remote takeover vulnerability exists in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0), a component of Oracle Fusion Middleware. The flaw is reachable over the network via HTTP and requires no credentials or user interaction to exploit. Successful exploitation gives an attacker full control of the WebCenter Sites instance, with impacts to confidentiality, integrity, and availability that extend beyond the directly targeted product (scope change). HarborGuard is tracking the advisory for patch availability, as no fix version has been published by Oracle at this time.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WebCenter Sites HTTP service over the network; no local or physical access is required.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerability is exploitable by an entirely unauthenticated attacker.

• Victim interactionNot required

  The attacker does not need to trick or involve any user; exploitation is entirely attacker-driven.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, special memory layout, or environmental prerequisites apply.

Blast Radius

• A successful attacker reads all data stored in and accessible through WebCenter Sites, including content, configuration, and any integrated credentials.
• The attacker can modify or destroy persisted content, site configuration, and data in connected backend systems.
• The attacker can crash or render the WebCenter Sites service unavailable, disrupting web content delivery.
• Because the CVSS scope is changed, compromise extends beyond WebCenter Sites itself and can affect other products and services running in the same environment.