CVE-2026-46797 is a critical security vulnerability affecting Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0. It allows unauthenticated remote attackers to exploit the system over HTTP without any user interaction or privileges, leading to full compromise of the WebCenter Sites product. The vulnerability is scored 9.8 on the CVSS 3.1 scale, reflecting high severity with impacts on confidentiality, integrity, and availability. Oracle has addressed this vulnerability as part of its June 2026 Critical Security Patch Update, which includes 245 security patches across multiple Oracle products. While the advisory does not specify a distinct patch version for WebCenter Sites, Oracle strongly recommends applying the Critical Security Patch Update promptly to mitigate the risk. Temporary mitigations include blocking attack-related network protocols and limiting user privileges, though these may affect application functionality.

Successful exploitation of this vulnerability allows an unauthenticated attacker with network access via HTTP to take over Oracle WebCenter Sites completely. This results in full compromise of confidentiality, integrity, and availability of the affected system. The critical severity and CVSS score of 9.8 reflect the high risk posed by this vulnerability.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update immediately to remediate this vulnerability. The vendor advisory does not specify a separate patch version for Oracle WebCenter Sites but includes it in the comprehensive CSPU. Until patches are applied, risk can be partially mitigated by blocking network protocols required by the attack and removing unnecessary privileges from users. However, these mitigations may disrupt normal application functionality. Customers should prioritize patching as the primary remediation.