CVE-2026-46847: Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools)

Synopsis

A critical-severity vulnerability in Oracle WebCenter Portal (Runtime Tools component) allows a low-privileged attacker to reach the service over HTTPS and fully compromise the portal. The CVSS 3.1 scope is marked as Changed, meaning a successful attack can spill beyond WebCenter Portal itself and affect adjacent systems or services in the same environment. Exploitation grants the attacker complete control over confidentiality, integrity, and availability, which Oracle describes as a full product takeover. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WebCenter Portal service over the network via HTTPS; no local or physical access is required.

• AuthenticationRequired

  Any low-privilege account is sufficient; the attacker does not need administrator or elevated credentials.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker can exploit the vulnerability entirely on their own.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions, special memory layouts, or other unpredictable environmental factors.

Blast Radius

• A successful attacker reads all data stored in and accessible through Oracle WebCenter Portal, including user credentials, session tokens, and portal content.
• The attacker can modify or delete persisted portal data, configuration, and content managed by the Runtime Tools component.
• The attacker can crash or render the WebCenter Portal service unavailable, disrupting access for all portal users.
• Because the CVSS scope is Changed, the compromise can extend to other products or services sharing the same infrastructure, amplifying the impact beyond WebCenter Portal itself.