What is the CVSS score of CVE-2026-46814?

CVE-2026-46814 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Portal are affected by CVE-2026-46814?

Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 are vulnerable to account takeover by low-privileged remote attackers over HTTP, with confirmed scope escalation to adjacent Oracle Fusion…

How to fix or mitigate CVE-2026-46814?

24 HOURS: Identify all instances of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 in production and staging; assess network accessibility and business criticality of each. 7 DAYS: Implement network-level access controls restricting Portal administrative interfaces to authorized internal networks; enable detailed security logging on all affected systems. 30 DAYS: Upgrade affected Portal instances to the next available patched version when released by Oracle, or decommission systems if no upgrade path exists within organizational timelines.

Oracle WebCenter Portal CVE-2026-46814

EUVD-2026-37331 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Portal Oracle Corporation

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network HTTP exploit with low complexity by a low-privileged portal user; Security Framework flaw causes scope change and full CIA takeover of the portal and trusting Fusion Middleware components.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:51 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. While the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Takeover of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged remote attacker over HTTP, with a scope-changed impact reaching adjacent Oracle Fusion Middleware products (CVSS 9.9). The flaw resides in the Security Framework component and was disclosed by Oracle in its June 2026 Critical Patch Update. No public exploit identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a high-priority patching target.

Technical ContextAI

Oracle WebCenter Portal is an enterprise portal platform within Oracle Fusion Middleware used to build internal and customer-facing portals, often integrated with Oracle Identity Management, WebLogic Server, and back-end content/database services. The affected component is the Security Framework, the layer responsible for authentication, authorization, and session/credential handling across portal applications; weaknesses here commonly map to broken access control or improper authorization (CWE-285/CWE-863), though Oracle did not publish a specific CWE for this entry. The scope change (S:C) in the CVSS vector indicates the vulnerable security boundary is the portal itself, but the resulting compromise crosses into other Fusion Middleware components that trust the portal's security context, consistent with a Security Framework flaw that lets a portal-level identity be leveraged against downstream services.

RemediationAI

Patch available per vendor advisory: apply the June 2026 Oracle Critical Patch Update (https://www.oracle.com/security-alerts/cspujun2026.html) to Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0, following the WebCenter Portal section for the exact PSU/bundle patch IDs for your branch and any prerequisite WebLogic patches. Until the CPU is deployed, restrict HTTP access to the WebCenter Portal endpoints to trusted networks via a reverse proxy or WAF (trade-off: blocks legitimate remote portal users and federated SSO flows), tighten provisioning so that only strictly necessary accounts have the low-privilege portal access the attacker needs, and increase monitoring of authentication and authorization events in the Security Framework and downstream Fusion Middleware components for anomalous session escalation, since the scope-change impact means signs of compromise may surface outside the portal itself.