CVE-2026-46798 is an easily exploitable vulnerability in Oracle WebCenter Sites (part of Oracle Fusion Middleware) affecting versions 12.2.1.4.0 and 14.1.2.0.0. It allows unauthenticated attackers with network access over HTTP to compromise the system, potentially leading to full takeover. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 score of 10.0 and scope change affecting other Oracle products. Oracle's June 2026 Critical Security Patch Update advisory references this vulnerability among 245 security patches but does not explicitly confirm a dedicated patch or fix status for this CVE. Oracle urges customers to apply available patches without delay and consider network protocol blocking and privilege restrictions as temporary mitigations.

Successful exploitation of CVE-2026-46798 can result in complete compromise of Oracle WebCenter Sites, including full confidentiality, integrity, and availability loss. The vulnerability is exploitable remotely without authentication via HTTP, increasing the risk of widespread impact. Additionally, the scope of the vulnerability extends beyond WebCenter Sites, potentially affecting other Oracle products integrated or dependent on it. This represents a critical security risk for affected environments.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update promptly to address this and other vulnerabilities. Although the advisory does not explicitly confirm a dedicated patch for CVE-2026-46798, the update includes numerous security fixes for Oracle WebCenter Sites and related products. Until patches are applied, risk can be reduced by blocking network protocols required for exploitation (e.g., HTTP access to vulnerable services) and by removing unnecessary privileges or package access from users. These mitigations may impact application functionality and should be tested accordingly. Customers should monitor Oracle's advisory page for updates on patch availability and further guidance.