CVE-2026-46767: Oracle WebCenter Portal Auth Bypass Flaw

CVE-2026-46767 Overview

CVE-2026-46767 is an access control vulnerability [CWE-284] in the Composer component of Oracle WebCenter Portal, part of Oracle Fusion Middleware. The flaw allows a low-privileged attacker with network access via HTTP to compromise the affected product. Successful exploitation results in full takeover of Oracle WebCenter Portal and impacts confidentiality, integrity, and availability. The vulnerability has a scope change, meaning attacks may significantly impact additional products beyond the vulnerable component itself.

Critical Impact
An authenticated attacker with low privileges can take over Oracle WebCenter Portal over the network and pivot to additional products in scope.

Affected Products

Oracle WebCenter Portal 12.2.1.4.0
Oracle WebCenter Portal 14.1.2.0.0
Oracle Fusion Middleware (Composer component)

Discovery Timeline

2026-06-17 - CVE-2026-46767 published to NVD
2026-06-18 - Last updated in NVD database

Technical Details for CVE-2026-46767

Vulnerability Analysis

The vulnerability resides in the Composer component of Oracle WebCenter Portal. Composer provides runtime page customization and resource editing in the WebCenter Portal framework. The flaw is classified as Improper Access Control [CWE-284], meaning the component does not properly restrict who can perform privileged operations.

A low-privileged authenticated user can issue crafted HTTP requests to reach functionality that should be restricted. Because the scope changes during exploitation, the attacker can affect components beyond WebCenter Portal itself, including integrated Fusion Middleware services. The result is a complete takeover of the WebCenter Portal instance with high impact across confidentiality, integrity, and availability.

Root Cause

The root cause is missing or insufficient authorization checks on Composer endpoints. Privileges granted to standard users extend beyond their intended boundary, enabling them to invoke administrative or cross-tenant functionality. This is consistent with the Common Weakness Enumeration category for Improper Access Control [CWE-284].

Attack Vector

Exploitation requires only network access via HTTP and a valid low-privilege account. No user interaction is needed. An attacker authenticates against the portal, then sends crafted requests to Composer endpoints to escalate privileges or trigger restricted actions. No public proof-of-concept code is available at the time of publication.

// No verified exploit code is publicly available.
// See the Oracle Critical Patch Update advisory for technical details.

Detection Methods for CVE-2026-46767

Indicators of Compromise

Unexpected HTTP requests from authenticated low-privilege accounts to Composer URLs such as /webcenter/portal/... and Composer customization endpoints.
New or modified portal pages, resources, or task flows created outside of normal change windows.
Creation of new administrative users or role assignments within WebCenter Portal that do not correspond to approved tickets.
Outbound connections from the WebCenter Portal host to unknown infrastructure following suspicious HTTP activity.

Detection Strategies

Enable verbose access logging on the WebLogic managed servers hosting WebCenter Portal and correlate authenticated session IDs against requested Composer endpoints.
Baseline normal Composer usage per role and alert on low-privilege accounts invoking administrative customization actions.
Inspect WebCenter Portal audit logs for privilege changes, role assignments, and configuration edits initiated by non-administrative users.

Monitoring Recommendations

Forward WebLogic, WebCenter Portal, and OPSS audit logs to a centralized SIEM for retention and correlation.
Monitor for HTTP 200 responses on Composer administrative endpoints originating from accounts that historically only access read-only resources.
Track process and file changes on the WebCenter Portal host to identify post-exploitation persistence such as new deployment artifacts or scheduled jobs.

How to Mitigate CVE-2026-46767

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert to all affected WebCenter Portal deployments.
Inventory all Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 instances and prioritize internet-exposed systems first.
Audit accounts with portal access and remove or disable unused low-privilege accounts that could be abused for authenticated exploitation.
Rotate credentials and review administrative role assignments after patching to confirm no unauthorized changes occurred.

Patch Information

Oracle addressed CVE-2026-46767 in the June 2026 Critical Patch Update. Refer to the Oracle Security Alert for the specific patch identifiers and supported configurations. Apply the patch following Oracle Fusion Middleware patching procedures, including pre-patch backups of the domain and database schemas.

Workarounds

Restrict network access to WebCenter Portal Composer endpoints using a reverse proxy or web application firewall until patching is complete.
Enforce least privilege on WebCenter Portal roles and remove Composer customization rights from users who do not require them.
Require multi-factor authentication for all portal accounts to raise the cost of credential-based access by attackers.

bash

# Example: restrict Composer paths at an Apache reverse proxy
<Location /webcenter/portal/composer>
    Require ip 10.0.0.0/8
    Require valid-user
</Location>