CVE-2026-46797 Oracle Corporation CVE debrief

Who should care

Organizations using Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 should prioritize patching this vulnerability to prevent potential exploitation. The vulnerability's high CVSS score and the potential for unauthenticated attackers to compromise the site make it a critical concern for security teams.

Technical summary

The vulnerability in Oracle WebCenter Sites is caused by a weakness in the WebCenter Sites component. It has been assigned a CVSS score of 9.8, indicating a critical severity level. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating that the vulnerability allows unauthenticated attackers with network access via HTTP to compromise the site, potentially leading to a complete takeover.

Defensive priority

High

Recommended defensive actions

• Apply the patch provided by Oracle Corporation as soon as possible
• Review and update inventory to ensure all affected versions are identified and patched
• Implement compensating controls, such as monitoring and exception tracking, to detect potential exploitation attempts
• Verify that network access controls are in place to limit access to Oracle WebCenter Sites
• Consider implementing additional security measures, such as multi-factor authentication, to enhance site security

Evidence notes

The CVE record was published on 2026-06-17T10:53:57.313Z and has not been modified since then. The NVD entry is currently Analyzed. The vulnerability is described as easily exploitable, allowing unauthenticated attackers with network access via HTTP to compromise Oracle WebCenter Sites.

Official resources