What is the CVSS score of CVE-2026-46800?

CVE-2026-46800 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Sites are affected by CVE-2026-46800?

Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) contains a critical remote vulnerability enabling unauthenticated system takeover with CVSS 10.0 severity.

How to fix or mitigate CVE-2026-46800?

Within 24 hours: Identify all systems running Oracle WebCenter Sites 12.2.1.4.0 or 14.1.2.0.0 and classify by business criticality. Within 7 days: Implement network-level access controls to restrict connections to affected systems and activate monitoring for exploitation attempts. Within 30 days: Deploy vendor patch when released, or execute migration to alternative solutions if vendor timeline exceeds organizational risk tolerance.

Oracle WebCenter Sites CVE-2026-46800

EUVD-2026-37318 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Information Disclosure Oracle Oracle Webcenter Sites

10.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

HTTP-reachable, unauthenticated, low-complexity takeover with no user interaction; Oracle confirms scope change and full CIA impact on WebCenter Sites and adjacent components.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:57 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. While the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Remote unauthenticated takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 is possible over HTTP, with a maximum CVSS 3.1 base score of 10.0 and a scope change indicating impact beyond the WebCenter Sites boundary. Oracle's June 2026 Critical Patch Update advisory (cspujun2026) lists the issue as easily exploitable with no privileges or user interaction required. There is no public exploit identified at time of analysis and the flaw is not currently listed in CISA KEV.

Technical ContextAI

Oracle WebCenter Sites is an enterprise web experience and content management platform within the Oracle Fusion Middleware stack, typically deployed on WebLogic and exposed via HTTP/HTTPS for both authoring and delivery tiers. The CPE string cpe:2.3:a:oracle_corporation:oracle_webcenter_sites:*:*:*:*:*:*:*:* confirms the WebCenter Sites application itself is the vulnerable component rather than an underlying library. No CWE is assigned in the input, but the combination of network attack vector, low complexity, no privileges, scope change, and full CIA impact is characteristic of an authentication-bypass or unauthenticated remote code execution issue in an HTTP-facing handler that allows the attacker to break out of the application's security boundary and affect adjacent components (for example the underlying WebLogic container, file system, or integrated identity store).

RemediationAI

Patch available per vendor advisory: apply the Oracle Critical Patch Update of June 2026 for Oracle WebCenter Sites on both 12.2.1.4.0 and 14.1.2.0.0, following the bundle and prerequisite instructions in https://www.oracle.com/security-alerts/cspujun2026.html (exact patched build numbers are published in the CPU advisory and My Oracle Support patch matrix). Until the CPU can be deployed, restrict HTTP/HTTPS reachability of WebCenter Sites - particularly the management and delivery endpoints - to trusted networks via WAF rules, reverse-proxy ACLs, or network segmentation, and increase monitoring of WebCenter Sites and the underlying WebLogic logs for anomalous unauthenticated requests; note that ACL-based restrictions break public delivery sites and WAF virtual-patching without a vendor signature is best-effort only. Do not rely on disabling individual features as a workaround, as no feature-level mitigation is published in the advisory.