CVE-2026-46801: Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites)

Synopsis

A critical unauthenticated remote compromise vulnerability affects Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0, a web content management component of Oracle Fusion Middleware. The vulnerability is reachable over the network via HTTP with no credentials required and no user interaction needed, making it trivially exploitable from any network-adjacent or internet-facing position. Successful exploitation results in full takeover of the Oracle WebCenter Sites instance, including complete loss of confidentiality, integrity, and availability. No fix version has been published by Oracle; HarborGuard is tracking the advisory and will surface a patched-image rebuild the moment upstream releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle WebCenter Sites service over the network via HTTP; no local or physical access is required, meaning any internet-exposed or internally routable instance is in scope.

• AuthenticationNot required

  No credentials or account of any privilege level are needed; the attacker can begin exploitation as an anonymous, unauthenticated party.

• Victim interactionNot required

  Exploitation is entirely attacker-driven and requires no action from any user or administrator of the affected system.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions to succeed.

Blast Radius

• A successful attacker reads all data accessible to the WebCenter Sites application, including stored content, credentials, session tokens, and any secrets held in the application context.
• The attacker can write or modify persisted content, configuration, and database records managed by WebCenter Sites, enabling content defacement, data manipulation, or backdoor injection.
• The attacker can crash or render the WebCenter Sites service completely unavailable, disrupting publishing workflows and any front-end sites that depend on the platform.
• Full system takeover means the attacker can pivot from the compromised instance to other internal services reachable from the WebCenter Sites host.