CVE-2026-46809 affects Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 and is an easily exploitable vulnerability that allows unauthenticated attackers with network access via HTTP to compromise the system. Exploitation can result in unauthorized creation, deletion, or modification of critical data or complete unauthorized access to all data accessible through Oracle WebCenter Sites. The vulnerability has a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating network attack vector with low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact. Oracle's June 2026 Critical Security Patch Update includes patches addressing this vulnerability. Oracle strongly recommends applying these patches immediately. Workarounds such as blocking network protocols or removing unnecessary privileges may reduce risk temporarily but can affect application functionality.

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain unauthorized creation, deletion, or modification access to critical data or full access to all data accessible through Oracle WebCenter Sites. This compromises confidentiality and integrity of the data but does not impact availability. The vulnerability is critical with a CVSS score of 9.1.

Oracle has released a Critical Security Patch Update in June 2026 that addresses CVE-2026-46809. Customers should apply the provided security patches without delay to remediate this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or by removing unnecessary privileges from users, though these measures may disrupt normal application functionality. Patch status is confirmed by the vendor advisory. No indication of automatic or cloud service patching is present; manual patch application is required.