CVE-2026-46791 is a vulnerability in Oracle WebCenter Content (component: Content Server) version 14.1.2.0.0 that allows an unauthenticated attacker with network access via HTTP to compromise the system. The vulnerability results in unauthorized access to critical data or potentially all accessible data within Oracle WebCenter Content. The CVSS 3.1 base score is 7.5, indicating high severity, with a vector indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact. Oracle has published this vulnerability in its June 2026 Critical Security Patch Update advisory, which includes patches for this and other vulnerabilities across multiple Oracle products. The advisory strongly urges customers to apply patches without delay and provides documentation links for patch availability and installation instructions. No direct exploit in the wild is reported at this time.

Successful exploitation of this vulnerability allows an unauthenticated attacker to gain unauthorized access to critical or all accessible data in Oracle WebCenter Content 14.1.2.0.0. The impact is limited to confidentiality compromise; integrity and availability are not affected according to the CVSS vector. This could lead to exposure of sensitive information managed by the affected Oracle WebCenter Content instance.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which includes patches addressing CVE-2026-46791. Customers should review the patch availability documentation linked in the Oracle advisory to obtain and install the appropriate patches for Oracle WebCenter Content 14.1.2.0.0. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges from users to limit attack surface. Oracle advises applying patches promptly to avoid exploitation risks. Patch status is not explicitly confirmed in the advisory excerpt, so customers should consult the vendor advisory for current remediation guidance.