CVE-2026-46767 is a critical vulnerability in the Composer component of Oracle WebCenter Portal within Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.0.0. The flaw allows a low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal, potentially leading to complete takeover of the product. The vulnerability also has scope to impact additional Oracle products. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle’s June 2026 Critical Security Patch Update includes fixes for this vulnerability. No explicit patch version is stated in the advisory, but Oracle strongly recommends applying the update immediately. Workarounds include blocking network protocols required for exploitation and removing unnecessary privileges, though these may disrupt application functionality.

Successful exploitation allows an attacker with low privileges and network access via HTTP to fully compromise Oracle WebCenter Portal, resulting in complete takeover. The vulnerability impacts confidentiality, integrity, and availability of the affected system. Additionally, the attack may affect other Oracle products due to scope change. This poses a critical risk to organizations using the affected versions of Oracle WebCenter Portal.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability among others. Customers should apply the June 2026 Critical Security Patch Update without delay to remediate this issue. Until patches are applied, risk can be partially mitigated by blocking network protocols required for the attack and by removing unnecessary privileges from users, though these measures may impact application functionality. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches. Patch status is not explicitly detailed for this vulnerability alone; consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for current patch availability and installation instructions.