CVE-2026-46846: Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework)

Synopsis

A critical authentication bypass vulnerability exists in the Security Framework component of Oracle WebCenter Portal (versions 12.2.1.4.0 and 14.1.2.0.0). An unauthenticated attacker with HTTP access to the portal can reach the vulnerable component over the network with no credentials required and no user interaction needed. Successful exploitation results in full takeover of Oracle WebCenter Portal, including complete read, write, and availability impact across the product and potentially additional connected systems due to a scope change. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Oracle WebCenter Portal service over the network via HTTP; no local access or special network position is needed.

• AuthenticationNot required

  No credentials of any privilege level are required; the vulnerability is exploitable by a completely unauthenticated attacker.

• Victim interactionNot required

  No user action such as clicking a link or opening a file is needed to trigger exploitation.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and repeatable without depending on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• A successful attacker gains full read access to all data stored in or accessible through Oracle WebCenter Portal, including documents, user data, and session material.
• The attacker can modify or delete any persisted content, configurations, and access-control rules within the portal.
• The attacker can crash or render the portal service unavailable to all users.
• Due to the scope change in the CVSS vector, systems and services that trust or integrate with Oracle WebCenter Portal are also at risk of compromise beyond the portal itself.