CVE-2026-46801 is a critical security vulnerability affecting Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0. The flaw allows an unauthenticated attacker with network access over HTTP to compromise the system, potentially resulting in full takeover of Oracle WebCenter Sites. The vulnerability is scored 9.8 on the CVSS 3.1 scale, reflecting high severity with impacts on confidentiality, integrity, and availability. Oracle has acknowledged this vulnerability in its June 2026 Critical Security Patch Update advisory, which includes 245 security patches across multiple products. While the advisory does not explicitly list a specific patch version for WebCenter Sites, it strongly recommends applying the Critical Security Patch Update immediately to mitigate the risk. Workarounds such as blocking network protocols or removing unnecessary privileges may reduce risk temporarily but can affect application functionality.

Successful exploitation of this vulnerability allows an unauthenticated attacker with network access via HTTP to fully compromise Oracle WebCenter Sites. This can lead to complete takeover of the system, impacting confidentiality, integrity, and availability of the affected product.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update promptly to address this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or by removing unnecessary privileges from users. However, these mitigations may disrupt normal application functionality. Customers should follow Oracle's official patch availability documentation and installation instructions linked in the advisory.