CVE-2026-46802 is a vulnerability in the Security Framework component of Oracle WebCenter Portal, affecting versions 12.2.1.4.0 and 14.1.2.0.0. It allows an attacker with low privileges and network access via HTTP to compromise the portal, resulting in full takeover. The vulnerability has a CVSS 3.1 base score of 9.9, indicating critical severity with high impact on confidentiality, integrity, and availability. The vulnerability also has scope change implications, potentially impacting other Oracle products. Oracle's June 2026 Critical Security Patch Update includes patches for this vulnerability. The vendor strongly advises applying these patches promptly. Workarounds include blocking network protocols required for exploitation and removing unnecessary privileges, though these may disrupt normal operations.

Successful exploitation of CVE-2026-46802 allows an attacker with low privileges and network access via HTTP to fully compromise Oracle WebCenter Portal, impacting confidentiality, integrity, and availability. This can lead to complete takeover of the portal and may affect additional Oracle products due to scope change. The vulnerability is rated critical with a CVSS score of 9.9.

Oracle has released a Critical Security Patch Update in June 2026 that addresses CVE-2026-46802 among other vulnerabilities. Customers are strongly advised to apply these security patches without delay. Until patches are applied, risk can be partially mitigated by blocking network protocols required for exploitation and by removing unnecessary privileges from users. However, these mitigations may impact application functionality. Patch status is not explicitly stated in the advisory, but the presence of the Critical Security Patch Update strongly indicates that an official fix is available. Customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for detailed patch availability and installation instructions.