This vulnerability affects Oracle WebCenter Content version 14.1.2.0.0 and involves an easily exploitable flaw that allows unauthenticated attackers with network access over HTTPS to compromise the system. Exploitation requires user interaction from a third party. The vulnerability can lead to unauthorized access to critical data and unauthorized update, insert, or delete operations on some data. The scope of impact extends beyond Oracle WebCenter Content to other Oracle products. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, high confidentiality impact, low integrity impact, and no availability impact. Oracle has published a Critical Security Patch Update advisory for June 2026 but does not explicitly confirm patch availability for this specific vulnerability in the provided content.

Successful exploitation can result in unauthorized access to critical data and unauthorized modification (update, insert, delete) of some data within Oracle WebCenter Content. The vulnerability affects confidentiality and integrity, with a high confidentiality impact and low integrity impact. The scope change means additional Oracle products may also be impacted. There are no reported exploits in the wild at this time.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this and other vulnerabilities. The vendor advisory does not explicitly confirm a specific patch for CVE-2026-46806 but advises applying the full Critical Security Patch Update. Until patches are applied, risk may be reduced by blocking network protocols required by the attack or removing unnecessary privileges and access to relevant packages, though these may impact functionality. Customers should refer to the official Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for detailed patch availability and installation instructions.