CVE-2026-46799: Oracle WebCenter Sites Auth Bypass Flaw

CVE-2026-46799 Overview

CVE-2026-46799 is a critical vulnerability in Oracle WebCenter Sites, a component of Oracle Fusion Middleware. The flaw allows an unauthenticated remote attacker with network access via HTTP to compromise the affected system. Successful exploitation results in complete takeover of the WebCenter Sites instance, impacting confidentiality, integrity, and availability. Oracle has classified the issue as easily exploitable, with no user interaction required. The vulnerability is associated with CWE-306: Missing Authentication for Critical Function.

Critical Impact
An unauthenticated attacker reachable over HTTP can take over Oracle WebCenter Sites, gaining full control over content, configuration, and underlying application data.

Affected Products

Oracle WebCenter Sites 12.2.1.4.0
Oracle WebCenter Sites 14.1.2.0.0
Oracle Fusion Middleware deployments embedding the affected WebCenter Sites component

Discovery Timeline

2026-06-17 - CVE-2026-46799 published to the National Vulnerability Database
2026-06-17 - Oracle publishes security alert advisory cspujun2026
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-46799

Vulnerability Analysis

The vulnerability resides in the WebCenter Sites component of Oracle Fusion Middleware. According to Oracle's advisory, the flaw is reachable over HTTP and requires no authentication, no privileges, and no user interaction. The CWE-306 mapping indicates that a critical function is exposed without enforcing authentication checks. An attacker can interact with that function directly to manipulate application state or execute privileged operations. Successful exploitation leads to full takeover of the WebCenter Sites instance, meaning the attacker can read or modify managed content, alter site configurations, and pivot into adjacent Fusion Middleware services.

Root Cause

The root cause is a missing authentication control on a critical function exposed by WebCenter Sites. Requests that should require an authenticated administrative session are processed without verifying the requester's identity. Oracle has not published the specific endpoint or request structure, but the issue affects both supported branches (12.2.1.4.0 and 14.1.2.0.0), suggesting a shared code path between releases.

Attack Vector

The attack vector is network-based over HTTP or HTTPS. An attacker only needs to reach the WebCenter Sites application's web interface to send a crafted request to the unauthenticated endpoint. Internet-exposed deployments are at the highest risk, but internal instances are also exploitable by any actor with network connectivity, including compromised internal hosts. No prior credentials, social engineering, or user interaction are required.

No public proof-of-concept code has been published at this time. Refer to the Oracle Security Alert Advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-46799

Indicators of Compromise

Unauthenticated HTTP or HTTPS requests to WebCenter Sites administrative or management endpoints originating from unexpected source addresses.
Creation of new administrator accounts, content publishing roles, or site configurations in WebCenter Sites audit logs without a corresponding authenticated session.
Unexpected outbound connections from the WebCenter Sites application server, indicating post-exploitation activity.
New or modified JSP, template, or asset files in the WebCenter Sites web root not tied to a release deployment.

Detection Strategies

Inspect WebCenter Sites and fronting web server access logs for HTTP requests to administrative paths that return successful responses without a preceding authentication request.
Correlate WebCenter Sites audit events with identity provider logs to flag privileged actions that lack a matching authentication record.
Monitor the application server process for spawning of shells, scripting interpreters, or file write operations outside the normal deployment workflow.

Monitoring Recommendations

Forward WebCenter Sites application, audit, and HTTP server logs to a centralized analytics platform and retain them for at least 90 days.
Alert on bursts of requests to WebCenter Sites management URIs from a single source, particularly from outside the corporate network.
Track file integrity on the WebCenter Sites deployment directories and alert on modifications outside of change windows.

How to Mitigate CVE-2026-46799

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert Advisory to all WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 instances.
Restrict network access to WebCenter Sites administrative interfaces using firewalls, reverse proxies, or VPN gating until the patch is applied.
Review audit logs and authentication records for signs of unauthenticated administrative actions since the publication date.
Rotate administrative credentials, API keys, and session secrets used by WebCenter Sites after patching if exposure is suspected.

Patch Information

Oracle has published fixes for CVE-2026-46799 as part of its security alert cspujun2026. Administrators should download the applicable patch for their version from My Oracle Support and apply it following Oracle's standard Fusion Middleware patching procedures. Validate the patch level after installation by checking the WebCenter Sites version inventory.

Workarounds

Block external access to WebCenter Sites administrative endpoints at the perimeter and allowlist only trusted management networks.
Place WebCenter Sites behind a web application firewall configured to deny unauthenticated requests to management and content publishing paths.
Disable or isolate any internet-facing WebCenter Sites instance that cannot be patched immediately.

bash

# Example reverse proxy rule to restrict access to management paths until patched
# nginx configuration snippet
location ~* ^/(cs|sites)/(Satellite|ContentServer)/.*(login|admin|publish) {
    allow 10.0.0.0/8;       # internal management network
    deny  all;
    proxy_pass http://webcenter_sites_backend;
}