What is the CVSS score of CVE-2026-46798?

CVE-2026-46798 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Sites are affected by CVE-2026-46798?

Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 can be remotely taken over by unauthenticated attackers, potentially affecting adjacent systems and creating immediate risk of data breach…

How to fix or mitigate CVE-2026-46798?

Within 24 hours: Identify all systems running Oracle WebCenter Sites 12.2.1.4.0 or 14.1.2.0.0; assess network segmentation and access controls. Within 7 days: Apply June 2026 Critical Patch Update to all affected systems after non-production testing; coordinate downtime with business stakeholders. Within 30 days: Verify 100% remediation; conduct security assessment of WebCenter Sites infrastructure; update asset inventory.

Oracle WebCenter Sites CVE-2026-46798

EUVD-2026-37316 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Information Disclosure Oracle Oracle Webcenter Sites Oracle Corporation

10.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

Vendor describes unauthenticated, network-reachable, easily exploitable takeover with scope change and full CIA impact, matching AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:58 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. While the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 is possible by unauthenticated network attackers over HTTP, with a CVSS 3.1 base score of 10.0 reflecting a scope change that can impact adjacent products. No public exploit identified at time of analysis, but Oracle has rated the issue as easily exploitable and released a fix in the June 2026 Critical Patch Update.

Technical ContextAI

Oracle WebCenter Sites is a Java-based web experience management (WEM) platform within Oracle Fusion Middleware, used by enterprises to deliver multichannel marketing and content sites. The CPE entry cpe:2.3:a:oracle_corporation:oracle_webcenter_sites covers the WebCenter Sites component itself, and the scope-change indicator (S:C) in the CVSS vector implies the vulnerable component can affect resources beyond its own security authority - typically the host application server (e.g., WebLogic) or integrated downstream systems. No CWE has been assigned by Oracle (consistent with Oracle's habitual non-disclosure of root-cause technical detail in CPU advisories), so the underlying weakness class - likely deserialization, authentication bypass, or expression-language injection given the unauthenticated-RCE-class impact - cannot be confirmed from public data.

RemediationAI

Apply the patches delivered in the Oracle Critical Patch Update of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html) for the affected 12.2.1.4.0 and 14.1.2.0.0 branches - this is the primary, vendor-released fix. Until the CPU bundle can be deployed, restrict network reachability of the WebCenter Sites HTTP endpoints to trusted management networks via firewall/ACL or a reverse-proxy allowlist, and consider placing a WAF in blocking mode in front of the Sites delivery and management URIs (trade-off: WAF rules tuned generically may break legitimate content-management workflows and editor previews, and IP allowlisting will break partner/CDN integrations that originate from outside the trusted ranges). Disable or firewall any externally exposed Sites admin/REST endpoints that are not strictly required, and audit web-tier logs for anomalous unauthenticated POSTs to Sites servlets while patching is planned.