Oracle WebCenter Portal CVE-2026-46846

No special conditions - remote unauthenticated exploitation against default configurations of Oracle WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0 over HTTP, as confirmed by AV:N/AC:L/PR:N/UI:N. The only practical limiting factor is network reachability to the WebCenter HTTP listener: instances deployed strictly on internal networks behind authenticating reverse proxies, VPNs, or WAFs that block unauthenticated traffic to /webcenter and related Security Framework URIs are not directly reachable. There is no requirement for user interaction, no required authentication, no privileged account, and no non-default configuration toggle mentioned by Oracle.

Every available signal points to maximum priority: CVSS 3.1 base score of 10.0 with AV:N/AC:L/PR:N/UI:N (remote, low complexity, no auth, no user interaction), scope change (S:C) extending impact beyond the vulnerable component, and full C:H/I:H/A:H impact culminating in 'takeover.' Oracle's own advisory language ('Easily exploitable') reinforces the CVSS vector rather than contradicting it. The vulnerability is NOT currently listed in CISA KEV and no POC has been published at time of analysis, and no EPSS score was supplied in the input - so claims of mass exploitation cannot be made, but absence of public exploit code is a weak control given Oracle WebCenter's history of being reverse-engineered from CPU advisories within days of release (e.g., prior WebCenter and WebLogic CPU bugs have repeatedly seen exploits within 1-2 weeks). No CWE was assigned, which limits root-cause analysis. Treat as imminent-exploitation risk for any internet-exposed or DMZ-deployed WebCenter Portal instance.

An unauthenticated attacker on any network with HTTP/HTTPS reach to the WebCenter Portal managed server sends a crafted request to a Security Framework endpoint and obtains full administrative control of the WebCenter instance without user interaction. Because of the CVSS scope change, the attacker then pivots from the compromised WebCenter identity broker into downstream Fusion Middleware services that trust its assertions - accessing content repositories, identity stores, or backing WebLogic domains - to exfiltrate enterprise data and establish persistence. No public exploit identified at time of analysis, but the AC:L / PR:N profile and Oracle's 'easily exploitable' wording mean weaponization is straightforward once the patch is reversed.