CVE-2026-46800 is an easily exploitable vulnerability in Oracle WebCenter Sites (Oracle Fusion Middleware component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. It permits unauthenticated attackers with network access over HTTP to compromise the product, resulting in full takeover. The vulnerability has a CVSS 3.1 base score of 10.0, indicating critical impact on confidentiality, integrity, and availability. The vulnerability also has scope change implications, potentially affecting additional Oracle products. Oracle has addressed this vulnerability as part of its June 2026 Critical Security Patch Update, which includes 245 security patches across multiple products. The vendor strongly urges customers to apply these patches without delay. No explicit patch links or fixed version details for Oracle WebCenter Sites were provided in the advisory, so patch status should be verified directly with Oracle's official resources.

Successful exploitation allows an unauthenticated attacker with network access via HTTP to fully compromise Oracle WebCenter Sites, resulting in complete takeover. This includes full loss of confidentiality, integrity, and availability of the affected product. The vulnerability may also impact additional Oracle products due to scope change. The CVSS score of 10.0 reflects critical severity with network attack vector, no required privileges or user interaction, and complete system compromise.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update immediately to address this vulnerability. While the advisory does not explicitly confirm patch availability for Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0, the vulnerability is included in this update. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and removing unnecessary privileges or package access from users, though these measures may disrupt application functionality. Customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.