CVE-2026-46786 affects Oracle WebCenter Content version 14.1.2.0.0 and allows an unauthenticated attacker with network access over HTTP to compromise the system. Successful exploitation requires user interaction from a third party and can result in complete takeover of the Oracle WebCenter Content product. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS 3.1 score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Oracle has published this vulnerability as part of its June 2026 Critical Security Patch Update advisory. The advisory strongly recommends applying the provided patches immediately. Workarounds include blocking network protocols required for exploitation and removing unnecessary privileges, though these may affect application functionality.

Successful exploitation of this vulnerability can lead to full compromise of Oracle WebCenter Content 14.1.2.0.0, impacting confidentiality, integrity, and availability of the system. The vulnerability also has scope to affect additional Oracle products beyond WebCenter Content. The CVSS score of 9.6 reflects critical severity with network attack vector, no privileges required, low attack complexity, but requiring user interaction. This can result in takeover of the affected product and potentially broader impact within the environment.

Oracle has released security patches for this vulnerability in the June 2026 Critical Security Patch Update. Customers should apply these patches without delay to remediate the vulnerability. Until patches are applied, risk can be mitigated by blocking network protocols required for exploitation and by removing unnecessary privileges or access to packages for users who do not need them. These mitigations may impact application functionality, so Oracle recommends prioritizing patch application. Patch status is confirmed by the vendor advisory.