CVE-2026-46803 is a vulnerability in the Security Framework component of Oracle WebCenter Portal, affecting versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by unauthenticated attackers over HTTP, allowing full compromise of the portal. The vulnerability has a CVSS 3.1 base score of 10.0, indicating critical severity with high impact on confidentiality, integrity, and availability. The vulnerability may also affect other Oracle products due to scope change. Oracle's June 2026 Critical Security Patch Update includes patches addressing this issue. The vendor strongly recommends applying these patches immediately to prevent exploitation.

Successful exploitation of this vulnerability allows an unauthenticated attacker with network access via HTTP to take over Oracle WebCenter Portal. This results in complete compromise of confidentiality, integrity, and availability of the affected system. Additionally, due to scope change, other Oracle products integrated or related to WebCenter Portal may also be impacted. The CVSS score of 10.0 reflects the critical nature and potential widespread damage of this vulnerability.

Oracle has released a Critical Security Patch Update in June 2026 that addresses CVE-2026-46803 among other vulnerabilities. Customers should apply the June 2026 Critical Security Patch Update without delay to remediate this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required by an attack or by removing unnecessary privileges from users, though these measures may impact application functionality. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches as the primary mitigation.