CVE-2026-46844: Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework)

Synopsis

A critical vulnerability in the Security Framework component of Oracle WebCenter Portal (versions 12.2.1.4.0 and 14.1.2.0.0) allows a low-privileged, network-authenticated attacker to fully compromise the portal via HTTPS. Because the CVSS vector includes a scope change, successful exploitation reaches beyond WebCenter Portal itself and affects other products in the environment. A successful attack results in complete takeover: full read access, modification of data, and disruption of availability across the affected system and potentially adjacent services. HarborGuard is tracking the Oracle advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WebCenter Portal HTTPS endpoint over the network; no physical or local access is needed.

• AuthenticationRequired

  Any low-privilege account is sufficient; the attacker does not need administrative credentials, but some form of valid login is required.

• Victim interactionNot required

  No user action is needed; the attacker can trigger the vulnerability without involving any other person.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, special memory layouts, or environmental prerequisites are required.

Blast Radius

• Reads all data stored in WebCenter Portal, including session tokens, user profile data, and portal content.
• Modifies or deletes persisted portal data, configurations, and security policy settings.
• Crashes or degrades the WebCenter Portal service, making it unavailable to all users.
• Because the scope changes, the attacker can pivot to compromise other Oracle Fusion Middleware products sharing the same environment.