CVE-2026-46802 is a security vulnerability in the Security Framework component of Oracle WebCenter Portal within Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.0.0. The flaw allows an attacker with low privileges and network access over HTTP to compromise the Oracle WebCenter Portal, with potential scope change impacting additional Oracle products. The vulnerability is rated critical with a CVSS 3.1 score of 9.9, reflecting high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability. The vendor strongly recommends applying these patches immediately to prevent exploitation. Workarounds such as blocking network protocols or removing unnecessary privileges may reduce risk but could disrupt application functionality.

Successful exploitation of this vulnerability can lead to complete takeover of Oracle WebCenter Portal, compromising confidentiality, integrity, and availability of the affected system. The vulnerability's scope change means that other Oracle products integrated or dependent on WebCenter Portal may also be significantly impacted. The critical CVSS score of 9.9 underscores the severity and potential for widespread damage if exploited.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability among others. Customers should apply the June 2026 Critical Security Patch Update without delay to remediate this issue. Until patches are applied, risk may be mitigated by blocking network protocols required for exploitation and by removing unnecessary privileges from users, though these measures may affect application functionality. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches. Patch status is confirmed as available via the June 2026 Critical Security Patch Update advisory (https://www.oracle.com/security-alerts/cspujun2026.html).