What is the CVSS score of CVE-2026-46802?

CVE-2026-46802 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Portal are affected by CVE-2026-46802?

Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical account takeover vulnerability (CVSS 9.9) that bypasses the Security Framework and enables unauthorized access to…

How to fix or mitigate CVE-2026-46802?

Within 24 hours: inventory all WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 instances; restrict network access to trusted sources only. Within 7 days: contact Oracle Support for patch timeline; implement multi-factor authentication on administrative accounts and enhanced logging of authentication events. Within 30 days: deploy vendor patch to all affected instances immediately upon availability.

Oracle WebCenter Portal CVE-2026-46802

EUVD-2026-37320 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Oracle Oracle Webcenter Portal Authentication Bypass

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

HTTP-reachable Security Framework flaw exploitable by any low-privileged portal user with no UI, and Oracle confirms scope change with full CIA impact across adjacent Fusion Middleware products.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:56 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. While the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the Security Framework component and pivot into adjacent products via a scope change. The flaw carries a CVSS 3.1 base score of 9.9 with high impact across confidentiality, integrity, and availability, and no public exploit identified at time of analysis. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain low-privileged portal account

Delivery

Reach WebCenter Portal HTTP endpoint

Exploit

Abuse Security Framework authorization flaw

Execution

Escalate within portal (scope change)

Persist

Pivot to integrated Fusion Middleware products

Impact

Full takeover of portal and adjacent systems

Access

Obtain low-privileged portal account

Delivery

Reach WebCenter Portal HTTP endpoint

Exploit

Abuse Security Framework authorization flaw

Execution

Escalate within portal (scope change)

Persist

Pivot to integrated Fusion Middleware products

Impact

Full takeover of portal and adjacent systems

Vulnerability AssessmentAI

Exploitation	Attacker must reach the Oracle WebCenter Portal HTTP interface over the network and hold a low-privileged authenticated session on a vulnerable 12.2.1.4.0 or 14.1.2.0.0 deployment (PR:L); no user interaction, no admin role, and no non-default configuration are required per Oracle's 'easily exploitable' rating. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	All available signals point to a high-priority issue: CVSS 3.1 base score of 9.9 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H means network-reachable, low-complexity, single low-privilege account, no user interaction, and impact crossing security scope with full confidentiality/integrity/availability loss. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker obtains or is granted a low-privileged WebCenter Portal account (for example via self-registration, a partner federation, or compromised credentials) and sends crafted HTTP requests to the Security Framework component that abuse the authorization logic to take over the portal and, because of the scope change, reach into other Fusion Middleware-integrated products. No user interaction is required and Oracle rates exploitation as easy; no public exploit identified at time of analysis, but the low complexity makes exploit development plausible once details are reverse-engineered from the patch.
Remediation	Apply the patches from the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cspujun2026.html (June 2026 CPU) for Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0; exact post-patch build identifiers are not enumerated in the input and should be taken directly from the Oracle CPU patch matrix. … Detailed patch versions, workarounds, and compensating controls in full report.