CVE-2026-46802: Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework)

Synopsis

A critical vulnerability in the Security Framework component of Oracle WebCenter Portal (versions 12.2.1.4.0 and 14.1.2.0.0) allows a low-privileged attacker to reach the portal over HTTP and fully compromise it. No authentication beyond a basic user account is required, and the attack scope extends beyond the portal itself to other products in the environment. Successful exploitation gives the attacker complete control over confidentiality, integrity, and availability of the portal and potentially adjacent systems. No upstream fix version has been published; HarborGuard is tracking the advisory and will make a patched rebuild available as soon as Oracle ships one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle WebCenter Portal service over the network via HTTP; no local or physical access is needed.

• AuthenticationRequired

  Any valid low-privilege account is sufficient; administrative credentials are not required.

• Victim interactionNot required

  No action from another user or administrator is needed to trigger the vulnerability.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, memory-layout dependencies, or special environmental factors are required.

Blast Radius

• A successful attacker reads all data accessible within Oracle WebCenter Portal, including stored user sessions, portal content, and any credentials or tokens held by the application.
• The attacker can modify or delete portal content, configuration, and persisted application data.
• The attacker can crash or deny availability of the Oracle WebCenter Portal service entirely.
• Because the CVSS scope is changed, the attacker can pivot to compromise other products and services in the same environment that trust or integrate with the portal.