CVE-2026-46838: Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework)

Synopsis

A critical authentication-partial-bypass and privilege-escalation vulnerability exists in the Security Framework component of Oracle WebCenter Portal (versions 12.2.1.4.0 and 14.1.2.0.0). The flaw is reachable over the network via HTTPS and requires only a low-privileged account, with no user interaction needed. Successful exploitation gives an attacker full control over Oracle WebCenter Portal and can cascade into compromise of additional products in the same environment. No upstream fix has been published yet; HarborGuard is tracking the advisory and will surface a patched-image rebuild the moment Oracle releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle WebCenter Portal service over the network via HTTPS; no local or physical access is needed.

• AuthenticationRequired

  Any valid low-privilege account is sufficient; no administrative or elevated credentials are required to trigger the vulnerability.

• Victim interactionNot required

  No action from a logged-in user or administrator is needed; the attacker can exploit the flaw entirely on their own.

• Attack complexityDetail

  Exploitation is reliable and condition-free, with no race conditions or special environmental configuration required to succeed.

Blast Radius

• Reads all confidential content stored in WebCenter Portal, including documents, pages, and user session data.
• Modifies or deletes portal content, configurations, and persisted user data.
• Crashes or degrades the WebCenter Portal service, making it unavailable to users.
• Compromises additional products sharing the same Fusion Middleware environment due to scope change, extending the attacker's reach beyond the initial target.