What is the CVSS score of CVE-2026-46765?

CVE-2026-46765 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Portal are affected by CVE-2026-46765?

Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical privilege escalation vulnerability (CVE-2026-46765, CVSS 9.9) that allows any employee or contractor with system access…

How to fix or mitigate CVE-2026-46765?

24 hours: Identify all systems running WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0; immediately restrict logical and network access to the Composer component to administrative staff only; disable remote access where operationally feasible. 7 days: Deploy enhanced monitoring and alerting on privilege escalation attempts and unusual administrative activity; segregate affected systems from production networks and connected Fusion Middleware instances; audit and revoke unnecessary low-privilege user access. 30 days: Monitor Oracle security advisories for patch availability and test immediately upon release; evaluate remediation options including migration to patched versions (13.x or 15.x), system decommissioning for non-critical deployments, or architectural redesign with enhanced access controls.

Oracle WebCenter Portal CVE-2026-46765

EUVD-2026-37454 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Portal Oracle Corporation

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable Composer endpoint, low complexity, requires any authenticated low-privileged portal user, no UI; scope changes into adjacent Fusion Middleware with full CIA impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:13 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. While the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Privilege escalation and full takeover of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged remote attacker through the Composer component, with a scope change that lets the impact reach additional products in the Fusion Middleware stack. Oracle rates the flaw 9.9 CVSS due to the combination of low attack complexity, low privilege requirement, and full CIA impact, and no public exploit has been identified at time of analysis.

Technical ContextAI

Oracle WebCenter Portal is a Java EE-based enterprise portal framework within Oracle Fusion Middleware used to build collaborative intranet, extranet, and composite application sites on WebLogic Server. The vulnerable Composer component is the in-browser page/resource editor that lets authenticated users add, configure and arrange task flows, portlets and data bindings at runtime, meaning it parses and persists user-controlled definitions that are later rendered server-side. No CWE is assigned by Oracle, but the combination of low-privileged HTTP entry, scope change to other products, and full takeover is characteristic of an authorization or deserialization/template-injection class flaw in the Composer edit pipeline that escapes the WebCenter security boundary into the underlying WebLogic/MDS layer. The CPE cpe:2.3:a:oracle_corporation:oracle_webcenter_portal:*:*:*:* confirms the product scope, and EUVD enumerates exactly two supported branches (12.2.1.4.0 and 14.1.2.0.0).

RemediationAI

Apply the Oracle Critical Patch Update for June 2026 to both the 12.2.1.4.0 and 14.1.2.0.0 branches as published at https://www.oracle.com/security-alerts/cspujun2026.html - this is the only vendor-released fix and Oracle policy is that interim patches are not provided. Until the CPU is applied, restrict reachability of the Composer endpoints (typically under /webcenter and the Composer edit URLs) at the reverse proxy or WAF so only trusted administrative networks can reach edit mode, accepting that this will block legitimate runtime page customization for end users. Tighten account provisioning by disabling any self-registration, reviewing roles that grant Composer/edit privileges, and rotating credentials for low-privileged service or test accounts that could be reused by an attacker; monitor WebLogic and WebCenter audit logs for unusual Composer save or task-flow modification events while the patch window remains open.