CVE-2026-46767 is a vulnerability in the Composer component of Oracle WebCenter Portal within Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.0.0. The flaw is easily exploitable by a low privileged attacker with network access over HTTP, enabling compromise and potential takeover of the Oracle WebCenter Portal. The vulnerability has a critical CVSS 3.1 score of 9.9, reflecting high impact on confidentiality, integrity, and availability, and a scope change affecting additional Oracle products. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update advisory. The advisory emphasizes the importance of applying patches promptly and notes possible interim mitigations such as blocking network protocols or removing unnecessary privileges, though these may disrupt application functionality.

Successful exploitation allows an attacker with low privileges and network access via HTTP to fully compromise Oracle WebCenter Portal, resulting in complete takeover. This impacts confidentiality, integrity, and availability of the affected system. The vulnerability also has a scope change, meaning attacks may significantly affect other Oracle products beyond WebCenter Portal.

Oracle has released security patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches without delay. Until patches are applied, risk can be partially mitigated by blocking network protocols required for the attack or by removing unnecessary privileges from users. However, these mitigations may impact application functionality. Oracle recommends remaining on actively supported versions and promptly applying all relevant security updates. Patch status is confirmed by the vendor advisory linked.