CVE-2026-46800 is an easily exploitable vulnerability in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) that allows an unauthenticated attacker with network access via HTTP to compromise the system. The vulnerability affects confidentiality, integrity, and availability, potentially resulting in full takeover of Oracle WebCenter Sites and impacting other Oracle products. Oracle's June 2026 Critical Security Patch Update advisory references this vulnerability among 245 security patches released. While the advisory strongly urges customers to apply patches without delay, it does not explicitly confirm the patch status for this specific CVE in the provided text. Mitigation may include blocking attack-related network protocols and removing unnecessary privileges, though these may disrupt normal operations.

The vulnerability allows unauthenticated remote attackers to fully compromise Oracle WebCenter Sites, leading to complete loss of confidentiality, integrity, and availability of the affected system. The scope of impact may extend beyond WebCenter Sites to other Oracle products. This represents a critical security risk with a CVSS score of 10.0, indicating the highest severity level.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to remediate this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and removing unnecessary privileges from users. However, these mitigations may affect application functionality. Patch status for this specific vulnerability is not explicitly confirmed in the advisory content provided; therefore, customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.