CVE-2026-46799: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. in Oracle Corporation Oracle WebCenter Sites
CVE-2026-46799 is a critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to fully compromise the product, potentially leading to complete takeover. The vulnerability has a CVSS 3.1 base score of 9.8, indicating high impact on confidentiality, integrity, and availability. Oracle has included this vulnerability in its June 2026 Critical Security Patch Update, which contains numerous security fixes across multiple products. Oracle strongly recommends applying the provided patches promptly to mitigate the risk. No specific patch version for WebCenter Sites is explicitly detailed in the advisory content, so users should consult the official patch availability documentation linked by Oracle. Until patches are applied, risk reduction may be possible by blocking required network protocols or restricting privileges, though these may impact functionality.
AI Analysis
Technical Summary
CVE-2026-46799 is a critical security vulnerability affecting Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0. The flaw allows an unauthenticated attacker with network access over HTTP to compromise the system, potentially resulting in full takeover of Oracle WebCenter Sites. The vulnerability is scored 9.8 on the CVSS 3.1 scale, reflecting high severity with impacts on confidentiality, integrity, and availability. Oracle has addressed this vulnerability as part of its June 2026 Critical Security Patch Update, which includes 245 security patches across various Oracle products. The vendor advisory emphasizes the importance of applying these patches without delay. While the advisory does not specify a direct patch version for WebCenter Sites, it provides links to patch availability documents for affected products. Oracle also suggests temporary risk mitigation by blocking network protocols or limiting privileges, though these measures may affect application functionality.
Potential Impact
Successful exploitation of CVE-2026-46799 can lead to complete compromise of Oracle WebCenter Sites, affecting confidentiality, integrity, and availability of the system. An unauthenticated attacker with network access via HTTP can exploit this vulnerability, making it highly critical. The impact includes potential full takeover of the affected product, which could lead to unauthorized access, data breaches, and disruption of services.
Mitigation Recommendations
Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the June 2026 Critical Security Patch Update promptly to remediate this issue. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or by restricting privileges and access to vulnerable packages; however, these workarounds may disrupt normal application functionality. Users should consult the official Oracle patch availability documentation linked in the advisory for detailed patch installation instructions and verify the patch status for their specific versions.
CVE-2026-46799: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. in Oracle Corporation Oracle WebCenter Sites
Description
CVE-2026-46799 is a critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to fully compromise the product, potentially leading to complete takeover. The vulnerability has a CVSS 3.1 base score of 9.8, indicating high impact on confidentiality, integrity, and availability. Oracle has included this vulnerability in its June 2026 Critical Security Patch Update, which contains numerous security fixes across multiple products. Oracle strongly recommends applying the provided patches promptly to mitigate the risk. No specific patch version for WebCenter Sites is explicitly detailed in the advisory content, so users should consult the official patch availability documentation linked by Oracle. Until patches are applied, risk reduction may be possible by blocking required network protocols or restricting privileges, though these may impact functionality.
CVSS v3.1
Score 9.8critical
Affected software
pkg:maven/com.oracle.webcenter/sitesRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-46799 is a critical security vulnerability affecting Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0. The flaw allows an unauthenticated attacker with network access over HTTP to compromise the system, potentially resulting in full takeover of Oracle WebCenter Sites. The vulnerability is scored 9.8 on the CVSS 3.1 scale, reflecting high severity with impacts on confidentiality, integrity, and availability. Oracle has addressed this vulnerability as part of its June 2026 Critical Security Patch Update, which includes 245 security patches across various Oracle products. The vendor advisory emphasizes the importance of applying these patches without delay. While the advisory does not specify a direct patch version for WebCenter Sites, it provides links to patch availability documents for affected products. Oracle also suggests temporary risk mitigation by blocking network protocols or limiting privileges, though these measures may affect application functionality.
Potential Impact
Successful exploitation of CVE-2026-46799 can lead to complete compromise of Oracle WebCenter Sites, affecting confidentiality, integrity, and availability of the system. An unauthenticated attacker with network access via HTTP can exploit this vulnerability, making it highly critical. The impact includes potential full takeover of the affected product, which could lead to unauthorized access, data breaches, and disruption of services.
Mitigation Recommendations
Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the June 2026 Critical Security Patch Update promptly to remediate this issue. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or by restricting privileges and access to vulnerable packages; however, these workarounds may disrupt normal application functionality. Users should consult the official Oracle patch availability documentation linked in the advisory for detailed patch installation instructions and verify the patch status for their specific versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-05-18T15:55:10.299Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/cspujun2026.html","vendor":"Oracle"}]
Threat ID: 6a31b6110b89be688826596a
Added to database: 06/16/2026, 20:46:09 UTC
Last enriched: 06/24/2026, 16:26:39 UTC
Last updated: 08/01/2026, 07:18:00 UTC
Views: 76
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.