What is the CVSS score of CVE-2026-46767?

CVE-2026-46767 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Portal are affected by CVE-2026-46767?

Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical privilege escalation vulnerability allowing authenticated portal users to assume full administrative control, with…

How to fix or mitigate CVE-2026-46767?

Within 24 hours: Inventory all systems running Oracle WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0; restrict network access to the Composer component and enforce strict authentication controls limiting session privileges to authorized administrators. Within 7 days: Deploy Web Application Firewall rules targeting Composer anomalies; implement network segmentation isolating affected Portal instances from critical downstream systems and sensitive data repositories. Within 30 days: Establish priority patch management procedure with Oracle Support and prepare immediate deployment plan for any available security update; alternatively, execute migration to unaffected Oracle WebCenter Portal versions.

Oracle WebCenter Portal CVE-2026-46767

EUVD-2026-37456 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Portal Oracle Corporation

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable HTTP endpoint (AV:N), Oracle states easily exploitable (AC:L), any authenticated portal user suffices (PR:L), no victim interaction (UI:N), scope change into Fusion Middleware (S:C) with full takeover (C/I/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:12 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. While the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Privilege escalation to full takeover in Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged authenticated attacker with HTTP network access to compromise the Composer component and, due to a CVSS scope change, impact additional downstream products. The flaw carries a CVSS 3.1 base score of 9.9 and is marked easily exploitable by Oracle, though no public exploit identified at time of analysis. EPSS data and CISA KEV status are not provided in the available intelligence.

Technical ContextAI

The vulnerability resides in the Composer component of Oracle WebCenter Portal, a Java-based enterprise portal platform within the Oracle Fusion Middleware stack used for building internal collaboration and content-driven web applications. The Composer is the runtime customization framework that allows users to modify portal pages, add task flows, and edit content at runtime - historically a high-risk surface because it processes user-driven page mutations and serializes/deserializes portal state. Per the CPE string cpe:2.3:a:oracle_corporation:oracle_webcenter_portal, both maintained branches (12.2.1.4.0 and 14.1.2.0.0) are affected. No CWE was assigned by the reporter, but the combination of scope change (S:C), low privilege requirement, and full CIA impact is consistent with an authorization bypass or unsafe deserialization/expression-language flaw in Composer that breaks out of the portal's security boundary into the underlying WebLogic/Fusion Middleware container.

RemediationAI

Apply the patches from the Oracle Critical Patch Update of June 2026 referenced at https://www.oracle.com/security-alerts/cspujun2026.html as the primary remediation; Oracle bundles the WebCenter Portal fixes for 12.2.1.4.0 and 14.1.2.0.0 within that CPU and the exact post-patch build numbers are listed in the advisory's product-specific patch matrix. Where patching must be deferred, restrict network access to the WebCenter Portal HTTP/HTTPS endpoints to authenticated intranet ranges via a reverse proxy or WAF, disable or tightly ACL the Composer customization surface (page edit, task-flow add, resource catalog) so non-administrative roles cannot reach it - accepting that this breaks runtime page personalization for end users - and audit existing low-privileged portal accounts for anomalous Composer activity. Monitor WebLogic and WebCenter access logs for unexpected POSTs to /webcenter/spaces, /webcenter/portal and Composer MDS write paths, and consider rotating credentials/keys reachable from the portal domain given the scope-change impact.