CVE-2026-46845: Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework)

Synopsis

This is an authentication bypass (or equivalent unauthenticated remote compromise) vulnerability in the Security Framework component of Oracle WebCenter Portal, affecting versions 12.2.1.4.0 and 14.1.2.0.0. An attacker reachable over HTTPS needs no credentials and no help from a victim to exploit it. Successful exploitation results in full takeover of the Oracle WebCenter Portal instance, giving the attacker read, write, and denial-of-service capability over the system. No fix version has been published by Oracle; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle WebCenter Portal service over the network via HTTPS; internet or intranet exposure to the service is sufficient to attempt exploitation.

• AuthenticationNot required

  No account or credentials of any kind are needed; the vulnerability is exploitable by a completely anonymous attacker.

• Victim interactionNot required

  The attacker does not need to trick or wait for any user action; exploitation is fully attacker-driven.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special conditions, race timing, or knowledge of the target environment beyond network access.

Blast Radius

• The attacker gains full read access to all data stored in or accessible through the portal, including session tokens, user records, and any connected content repositories.
• The attacker can write or modify any portal content, configuration, or persisted data, enabling defacement, data manipulation, or privilege escalation within connected systems.
• The attacker can crash or render the Oracle WebCenter Portal service unavailable, disrupting all users and dependent workflows.
• Because the CVSS descriptor indicates full system takeover, the attacker can install persistent backdoors or pivot to adjacent systems reachable from the portal host.