CVE-2026-46814 is a critical security vulnerability in the Security Framework component of Oracle WebCenter Portal (versions 12.2.1.4.0 and 14.1.2.0.0). It enables a low privileged attacker with network access via HTTP to compromise the portal, potentially resulting in full system takeover. The vulnerability has a scope change effect, potentially impacting additional Oracle products. The CVSS 3.1 score is 9.9 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle’s June 2026 Critical Security Patch Update includes fixes for this vulnerability among 245 others. The vendor strongly recommends applying these patches immediately. Workarounds such as blocking network protocols or removing unnecessary privileges may reduce risk temporarily but could affect application functionality.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle WebCenter Portal, including full takeover of the system. The vulnerability affects confidentiality, integrity, and availability at a high level. Additionally, due to scope change, other Oracle products integrated or dependent on WebCenter Portal may also be significantly impacted. The vulnerability is exploitable remotely over the network via HTTP by an attacker with low privileges and requires no user interaction.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers are strongly advised to apply the provided security patches without delay to remediate this issue. Until patches are applied, risk can be partially mitigated by blocking network protocols required for exploitation and by removing unnecessary privileges from users who do not require them. However, these mitigations may disrupt normal application functionality. There is no indication that the vulnerability is already mitigated or that no action is required. Patch status is confirmed by the vendor advisory.