CVE-2026-46846 is a vulnerability in the Security Framework component of Oracle WebCenter Portal (Oracle Fusion Middleware) affecting versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by unauthenticated attackers over HTTP, allowing full compromise of the Oracle WebCenter Portal. The vulnerability has a CVSS 3.1 base score of 10.0, indicating critical severity with high impact on confidentiality, integrity, and availability. The vulnerability also has a scope change, meaning successful exploitation may impact additional Oracle products. Oracle has published a Critical Security Patch Update in June 2026 that includes patches for this vulnerability. Oracle strongly recommends applying these patches without delay. Until patches are applied, risk may be reduced by blocking attack-related network protocols or removing unnecessary privileges, though these mitigations may affect normal application functionality.

Successful exploitation of CVE-2026-46846 allows an unauthenticated attacker with network access via HTTP to take over Oracle WebCenter Portal, resulting in complete compromise of confidentiality, integrity, and availability of the product. The vulnerability's scope change indicates that additional Oracle products may also be significantly impacted. This represents a critical security risk to affected environments.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers should apply the June 2026 Critical Security Patch Update promptly to remediate this issue. Until patches are applied, risk can be partially mitigated by blocking network protocols required by the attack and by removing unnecessary privileges or access to packages for users who do not need them. However, these mitigations may disrupt application functionality. Oracle strongly recommends applying the official patches as the primary remediation measure.