This vulnerability (CVE-2026-46789) affects Oracle WebCenter Content version 14.1.2.0.0 and is classified as easily exploitable by an unauthenticated attacker with network access via HTTP. Successful exploitation requires user interaction from a third party and can result in complete compromise of Oracle WebCenter Content, with a scope change potentially impacting additional Oracle products. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and high impact on confidentiality, integrity, and availability (score 9.6). Oracle’s June 2026 Critical Security Patch Update advisory includes this vulnerability among 245 fixes and strongly urges customers to apply patches promptly. The advisory does not specify a dedicated patch version for this CVE but provides links to patch availability documents for affected products and versions, including Oracle WebCenter Content 14.1.2.0.0. Workarounds include blocking network protocols used in attacks and limiting user privileges, though these may disrupt normal operations.

Successful exploitation of CVE-2026-46789 can lead to full takeover of Oracle WebCenter Content, impacting confidentiality, integrity, and availability of the system. The vulnerability allows unauthenticated remote attackers to compromise the product via HTTP, requiring user interaction from a third party. The scope of impact may extend beyond Oracle WebCenter Content to other Oracle products. This represents a critical risk to affected environments.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which addresses this vulnerability among others. Customers should remain on actively supported versions and apply security patches without delay. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and removing unnecessary privileges from users, though these measures may affect application functionality. Patch status for this specific vulnerability is not explicitly stated but is included in the June 2026 CSPU advisory. Check the vendor advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.