CVE-2026-46803: Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework)

Synopsis

A critical authentication bypass (or equivalent unauthenticated takeover) vulnerability exists in the Security Framework component of Oracle WebCenter Portal, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The flaw is reachable over the network via HTTP and requires no credentials or user interaction to exploit. Successful exploitation gives an attacker full takeover of the portal, with spillover impact extending to additional products in the same environment. No fix version has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as Oracle ships a patch.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle WebCenter Portal service over the network via HTTP; no local or physical access is needed.

• AuthenticationNot required

  No credentials of any privilege level are required; the attacker can exploit this as a completely unauthenticated party.

• Victim interactionNot required

  No user or administrator action (such as clicking a link or opening a file) is needed to trigger the vulnerability.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special conditions, race timing, or knowledge of memory layout.

Blast Radius

• A successful attacker achieves full takeover of Oracle WebCenter Portal, gaining the ability to read all portal content and stored credentials, including session tokens and user account data.
• The attacker can modify or delete any persisted data within the portal, including pages, user configurations, and security policies.
• The attacker can crash or render the portal service fully unavailable, disrupting all dependent business workflows.
• Because the CVSS vector carries a scope change, the attacker can pivot from the portal to compromise additional co-located Fusion Middleware products beyond the initial target.