CVE-2026-46800 Oracle Corporation CVE debrief

Who should care

Administrators and users of Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes reviewing system configurations, monitoring for suspicious activity, and applying patches or updates as soon as possible. Additionally, security teams and vulnerability management teams should prioritize this vulnerability due to its critical severity and potential impact on multiple products.

Technical summary

The vulnerability is in the WebCenter Sites component of Oracle Fusion Middleware. It allows unauthenticated attackers with network access via HTTP to compromise Oracle WebCenter Sites. The CVSS Vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. This vulnerability affects Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0, and may have a significant impact on additional systems. The CVSS 3.1 Base Score is 10.0, indicating high impacts on Confidentiality, Integrity, and Availability.

Defensive priority

High, given the CVSS score of 10.0 and potential for significant impact on multiple products. Immediate action is recommended to mitigate the risk of exploitation and potential system compromise. Consider implementing additional security controls, such as Web Application Firewalls (WAFs), to protect against potential attacks. Monitor Oracle WebCenter Sites for suspicious activity and restrict access to only trusted networks and users. Apply the vendor's patch or update to the latest version as soon as possible. Review compensating controls for exposed systems while remediation is scheduled and verified. Track exceptions, retest remediated assets, and close the item only after evidence is documented. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Consider implementing additional security controls, such as Web Application Firewalls (WAFs), to protect against potential attacks. Monitor Oracle WebCenter Sites for suspicious activity and restrict access to only trusted networks and users. Apply the vendor's patch or update to the latest version as soon as possible. Review compensating controls for exposed systems while remediation is scheduled and verified. Track exceptions, retest remediated assets, and close the item only after evidence is documented. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Consider implementing additional security controls, such as Web Application Firewalls (WAFs), to protect against potential attacks. Monitor Oracle 7

Recommended defensive actions

• Apply the vendor's patch or update to the latest version
• Restrict access to Oracle WebCenter Sites to only trusted networks and users
• Monitor Oracle WebCenter Sites for suspicious activity
• Consider implementing additional security controls, such as Web Application Firewalls (WAFs)
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-06-17T10:53:57.630Z and last modified on 2026-06-17T19:27:53.820Z. The NVD entry is currently Analyzed. Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 are confirmed affected. Defenders should verify the system's configuration and review logs for potential exploitation attempts.

Official resources