CVE-2026-46777 affects Oracle WebCenter Content (component: Content Server) versions 12.2.1.4.0 and 14.1.2.0.0. It is an easily exploitable vulnerability that allows unauthenticated attackers with network access via HTTP to gain unauthorized creation, deletion, or modification access to critical data or full access to all Oracle WebCenter Content accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality and integrity impacts. Oracle’s June 2026 Critical Security Patch Update advisory includes this vulnerability among 245 security patches and urges customers to apply patches promptly. The advisory does not explicitly state patch availability for this specific CVE but strongly recommends applying the Critical Security Patch Update. Workarounds may include blocking network protocols or removing unnecessary privileges, though these may affect application functionality.

Successful exploitation of CVE-2026-46777 can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle WebCenter Content. This compromises confidentiality and integrity of the affected system’s data. There is no reported impact on availability. The vulnerability is exploitable remotely over HTTP without authentication, making it highly critical.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to remediate this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required by an attack or by removing unnecessary privileges from users who do not need them. However, these mitigations may disrupt application functionality. Customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for detailed patch availability and installation instructions. Patch status for this specific vulnerability is not explicitly confirmed in the advisory; therefore, customers should verify current remediation guidance from Oracle.