CVE-2026-46845 is a critical security vulnerability in Oracle WebCenter Portal's Security Framework component affecting versions 12.2.1.4.0 and 14.1.2.0.0. The flaw allows an unauthenticated attacker with network access over HTTPS to compromise the portal, leading to full system takeover. The vulnerability has a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its ease of exploitation and severe impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability as part of its June 2026 Critical Security Patch Update, which includes 245 security patches across multiple products. While no specific patch link for Oracle WebCenter Portal was provided, Oracle strongly advises customers to apply the Critical Security Patch Update without delay to remediate this and other vulnerabilities.

Successful exploitation of CVE-2026-46845 allows an unauthenticated remote attacker to fully compromise Oracle WebCenter Portal, resulting in complete takeover of the affected system. This impacts confidentiality, integrity, and availability of the portal, potentially leading to unauthorized data access, data modification, and service disruption.

Oracle has included fixes for this vulnerability in the June 2026 Critical Security Patch Update. Customers are strongly advised to apply this Critical Security Patch Update promptly to remediate the vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required by an attack or by removing unnecessary privileges from users, though these measures may affect application functionality. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch status for this specific vulnerability is managed through the Critical Security Patch Update; no separate patch link is provided.