What is the CVSS score of CVE-2026-46844?

CVE-2026-46844 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Webcenter Portal are affected by CVE-2026-46844?

Oracle WebCenter Portal vulnerability CVE-2026-46844 (CVSS 9.9) allows account takeover with potential scope expansion to downstream systems.

How to fix or mitigate CVE-2026-46844?

Within 24 hours: Identify all systems running Oracle WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0. Within 7 days: Deploy Oracle June 2026 Critical Patch Update to all affected WebCenter Portal instances. Within 30 days: Verify patch deployment across all systems and audit for unauthorized access.

Oracle Webcenter Portal CVE-2026-46844

EUVD-2026-37337 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Portal Oracle Corporation

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:49 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle WebCenter Portal. While the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 allows an authenticated low-privileged attacker to fully compromise the Portal over HTTPS and, due to a scope change, impact additional downstream products. Oracle rates the issue CVSS 9.9 and shipped fixes in the June 2026 Critical Patch Update; no public exploit identified at time of analysis, but the 'easily exploitable' wording and broad scope make this a high-priority Oracle CPU item.