CVE-2026-46797 affects Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 and is an easily exploitable vulnerability that allows unauthenticated attackers with network access via HTTP to compromise the system. Successful exploitation can lead to full takeover of Oracle WebCenter Sites, impacting confidentiality, integrity, and availability. The vulnerability is rated critical with a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability. Oracle strongly recommends applying these patches immediately. Until patches are applied, risk may be mitigated by blocking required network protocols or removing unnecessary privileges, though these may affect application functionality.

The vulnerability allows unauthenticated remote attackers to fully compromise Oracle WebCenter Sites, resulting in complete loss of confidentiality, integrity, and availability of the affected system. This can lead to takeover of the product and potentially the underlying environment.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers should apply the security patches as soon as possible. Until patches are applied, risk can be reduced by blocking network protocols required by an attack or removing unnecessary privileges from users, though these measures may disrupt application functionality. Oracle strongly recommends remaining on actively supported versions and applying patches without delay. Patch status is confirmed by the vendor advisory.