CVE-2026-46806 affects Oracle WebCenter Content version 14.1.2.0.0 and is an easily exploitable vulnerability that allows an unauthenticated attacker with network access via HTTPS to compromise the product. Successful exploitation requires user interaction from a third party and can result in unauthorized access to critical data or full access to all data accessible by Oracle WebCenter Content. The vulnerability also permits unauthorized update, insert, or delete operations on some data. The vulnerability impacts confidentiality and integrity, with a CVSS 3.1 score of 8.2 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N). The scope of impact may extend beyond Oracle WebCenter Content to additional Oracle products. Oracle’s June 2026 Critical Security Patch Update advisory references this vulnerability among many others and strongly urges customers to apply the update promptly. However, the advisory does not explicitly confirm a dedicated patch or fix for CVE-2026-46806 alone.

Successful exploitation of CVE-2026-46806 can lead to unauthorized access to critical and sensitive data within Oracle WebCenter Content, including potentially complete access to all accessible data. It also allows unauthorized modification of some data, impacting data integrity. The vulnerability requires network access via HTTPS and user interaction by a third party, increasing the attack complexity but still posing a significant risk given the high confidentiality impact. The vulnerability’s scope change indicates potential impact on additional Oracle products beyond WebCenter Content.

Oracle’s June 2026 Critical Security Patch Update advisory strongly recommends applying the update promptly to address this and other vulnerabilities. Although the advisory does not explicitly confirm a dedicated patch for CVE-2026-46806, applying the June 2026 Critical Security Patch Update is the recommended remediation. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and removing unnecessary privileges or access to vulnerable components, though these measures may affect application functionality. Customers should monitor Oracle’s advisory page for updated patch information and apply patches without delay.