CVE-2026-46809: Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites)

Synopsis

A critical unauthenticated access-control vulnerability affects Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0, reachable over HTTP from any network. The flaw requires no credentials and no user interaction, making it trivially exploitable by any attacker who can reach the service. Successful exploitation grants full read access to all data stored in the application as well as the ability to create, modify, or delete that data. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Oracle WebCenter Sites HTTP endpoint over a network; no local or physical access is needed.

• AuthenticationNot required

  No credentials of any kind are required; the vulnerability is exploitable by any unauthenticated attacker.

• Victim interactionNot required

  No user action is needed; the attacker can exploit the service directly without involving any human target.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental setup.

Blast Radius

• Reads all data stored in Oracle WebCenter Sites, including content, configuration, and any sensitive records accessible to the application.
• Creates, modifies, or deletes critical data across the entire Oracle WebCenter Sites data set, enabling persistent content tampering or data destruction.
• Because both confidentiality and integrity are fully compromised, an attacker can exfiltrate data and simultaneously alter or remove records to cover tracks or cause business disruption.