CVE-2026-46814: Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework)

Synopsis

A critical vulnerability in the Security Framework component of Oracle WebCenter Portal (versions 12.2.1.4.0 and 14.1.2.0.0) allows a low-privileged attacker to reach the service over HTTP and fully compromise the portal. No victim interaction is required, and the exploit is reliable under normal network conditions. Successful exploitation gives the attacker complete control over the portal, including read and write access to all data and the ability to crash the service, with impact extending beyond the portal itself to other products in the environment. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle WebCenter Portal service over the network via HTTP; no physical or local access is needed.

• AuthenticationRequired

  Any low-privilege account on the portal is sufficient; no administrative credentials are required.

• Victim interactionNot required

  The attacker does not need to trick or wait for any user to take an action; exploitation proceeds entirely attacker-side.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Reads all stored portal content, session tokens, and user account data accessible within Oracle WebCenter Portal.
• Modifies or deletes persisted portal pages, user records, and configuration data.
• Crashes the Oracle WebCenter Portal service, making it unavailable to all users.
• Compromises additional products sharing the same environment due to scope change, extending attacker reach beyond the portal itself.