CVE-2026-46784 is a vulnerability in Oracle Fusion Middleware's WebCenter Content: Imaging component (versions 12.2.1.4.0 and 14.1.2.0.0). It permits an unauthenticated attacker with network access over HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical or all accessible data. The vulnerability is rated critical with a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating it is remotely exploitable without authentication or user interaction and impacts confidentiality and integrity severely. Oracle's June 2026 Critical Security Patch Update addresses this and numerous other vulnerabilities. The vendor strongly advises applying the patches immediately to prevent exploitation. Workarounds include blocking network protocols required for exploitation or limiting privileges, but these may affect application functionality.

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to gain unauthorized creation, deletion, or modification access to critical data or all data accessible through Oracle WebCenter Content: Imaging. This results in a complete compromise of confidentiality and integrity of the affected data. Availability impact is not indicated. The vulnerability is exploitable remotely over HTTP without any privileges or user interaction, making it highly severe.

Oracle has released security patches addressing this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to remediate the vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or by removing unnecessary privileges from users; however, these mitigations may disrupt normal application functionality. Refer to the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for detailed patch availability and installation instructions.