What is the CVSS score of CVE-2026-46801?

CVE-2026-46801 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Sites are affected by CVE-2026-46801?

Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical unauthenticated remote takeover vulnerability (CVSS 9.8) enabling complete system compromise via HTTP.

How to fix or mitigate CVE-2026-46801?

Within 24 hours: conduct asset inventory to identify all Oracle WebCenter Sites installations on versions 12.2.1.4.0 and 14.1.2.0.0; implement immediate network segmentation to restrict HTTP/HTTPS access from untrusted sources. Within 7 days: monitor Oracle's Critical Patch Update (CPU) schedule for patch availability; establish change-control plan for rapid deployment and pre-production testing. Within 30 days: upon vendor patch release, apply to all production instances and validate deployment across affected versions before production release.

Oracle WebCenter Sites CVE-2026-46801

EUVD-2026-37319 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Information Disclosure Oracle Oracle Webcenter Sites Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated HTTP exploitation is easy and results in product takeover, so AV:N, AC:L, PR:N, UI:N, S:U with full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:56 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote unauthenticated takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 is possible over HTTP, with the vendor and CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) characterizing the flaw as easily exploitable and yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, the issue is not on the CISA KEV list, and no EPSS score was provided, but the 9.8 base score plus Oracle's 'takeover' wording make this a top-tier patching priority on the Oracle Critical Patch Update cycle.

Technical ContextAI

Oracle WebCenter Sites is the Java-based web experience management / content delivery platform within Oracle Fusion Middleware, typically deployed on WebLogic and reachable through HTTP/HTTPS for content delivery, preview, and administrative consoles. The CPE cpe:2.3:a:oracle_corporation:oracle_webcenter_sites covers the affected product, and EUVD enumerates the impacted releases as 12.2.1.4.0 and 14.1.2.0.0. Oracle did not publish a CWE, so the root cause class is not formally categorized, but the combination of unauthenticated HTTP exploitation and full system takeover is consistent with the deserialization, template-injection, or authentication-bypass bug classes historically seen in WebCenter Sites and other Fusion Middleware components.

RemediationAI

Apply the Oracle Critical Patch Update for June 2026 as documented at https://www.oracle.com/security-alerts/cspujun2026.html, which is the patch available per vendor advisory for WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0; Oracle does not publish a separate point release identifier in the description, so track the CPU patch number from the advisory for change management. Until patching is complete, restrict HTTP/HTTPS access to WebCenter Sites delivery and administration endpoints to trusted networks via firewall or reverse-proxy ACLs (trade-off: may break external content delivery and remote authoring), block or rate-limit anonymous access to management URIs at a WAF (trade-off: risk of bypass if signatures are imprecise), and increase monitoring of WebLogic/WebCenter Sites access logs for unauthenticated POSTs to admin and content APIs. Do not rely on disabling unused features as the description does not name a specific component switch.