CVE-2026-46801: Oracle WebCenter Sites Auth Bypass Flaw

CVE-2026-46801 Overview

CVE-2026-46801 is a critical vulnerability in Oracle WebCenter Sites, a component of Oracle Fusion Middleware. The flaw allows an unauthenticated attacker with network access via HTTP to compromise the product. Successful exploitation results in full takeover of Oracle WebCenter Sites, with impact across confidentiality, integrity, and availability. The vulnerability is mapped to [CWE-306] (Missing Authentication for Critical Function). Affected releases include versions 12.2.1.4.0 and 14.1.2.0.0. Oracle published the issue in its June 2026 Critical Patch Update.

Critical Impact
An unauthenticated remote attacker can take over Oracle WebCenter Sites over HTTP with low attack complexity and no user interaction.

Affected Products

Oracle WebCenter Sites 12.2.1.4.0
Oracle WebCenter Sites 14.1.2.0.0
Oracle Fusion Middleware deployments embedding the WebCenter Sites component

Discovery Timeline

2026-06-17 - CVE-2026-46801 published to NVD
2026-06-17 - Last updated in NVD database
June 2026 - Oracle releases fix in the Oracle Critical Patch Update Advisory

Technical Details for CVE-2026-46801

Vulnerability Analysis

The vulnerability resides in the WebCenter Sites component of Oracle Fusion Middleware. Oracle classifies the issue as easily exploitable and reachable by an unauthenticated attacker over HTTP. The CWE mapping [CWE-306] indicates a missing authentication check on a critical function. An attacker reaching the affected HTTP endpoint can perform actions that should require authenticated, privileged access. Because impact spans confidentiality, integrity, and availability, the attacker can read sensitive content, modify managed sites, and disrupt service. The EPSS score is 0.483% (percentile 37.8), reflecting current exploitation likelihood as estimated by EPSS rather than confirmed in-the-wild activity.

Root Cause

Oracle's advisory describes the defect at a component level and does not publish internal call paths. The [CWE-306] mapping indicates that one or more privileged operations in WebCenter Sites are exposed without enforcing authentication. Network-reachable handlers accept requests and execute sensitive logic without verifying caller identity. This design gap permits any HTTP client that can reach the service to invoke functionality reserved for administrators.

Attack Vector

The attack vector is network-based over HTTP. The attacker requires no credentials, no prior foothold, and no user interaction. An attacker scans for Internet-facing or internally reachable WebCenter Sites instances on versions 12.2.1.4.0 or 14.1.2.0.0, then issues crafted HTTP requests against the vulnerable endpoint. Because exploitation does not require chained conditions, mass scanning and opportunistic exploitation are realistic once technical details circulate. Refer to the Oracle Security Alert for product-specific guidance.

Detection Methods for CVE-2026-46801

Indicators of Compromise

Unexpected administrative actions in WebCenter Sites audit logs originating from unauthenticated or unfamiliar sessions.
New or modified site assets, templates, or user accounts that do not correspond to scheduled changes.
HTTP requests from external IP addresses hitting management or API endpoints of WebCenter Sites without prior authentication traffic.

Detection Strategies

Review WebCenter Sites and fronting web server logs for anomalous POST or PUT requests to administrative paths, particularly those lacking session cookies or Authorization headers.
Compare deployed Oracle Fusion Middleware versions against 12.2.1.4.0 and 14.1.2.0.0 to identify exposed hosts.
Hunt for outbound connections initiated by the WebCenter Sites application server to untrusted destinations following inbound HTTP bursts.

Monitoring Recommendations

Forward WebCenter Sites application, access, and audit logs to a centralized analytics platform for correlation.
Alert on creation of administrative users, template changes, and configuration writes outside change-control windows.
Track HTTP error and status code ratios on WebCenter Sites endpoints to surface scanning and enumeration behavior.

How to Mitigate CVE-2026-46801

Immediate Actions Required

Apply the fixes from the June 2026 Oracle Critical Patch Update to all WebCenter Sites instances running 12.2.1.4.0 or 14.1.2.0.0.
Restrict network exposure of WebCenter Sites administrative endpoints to trusted management networks until patching is complete.
Inventory all Oracle Fusion Middleware deployments to confirm which hosts include the WebCenter Sites component.

Patch Information

Oracle addressed CVE-2026-46801 in the June 2026 Critical Patch Update. Administrators should download and apply the corresponding patches for Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 as documented in the Oracle Critical Patch Update Advisory. Validate patch application by confirming build versions reported by the application server after restart.

Workarounds

Place WebCenter Sites behind an authenticating reverse proxy or web application firewall that blocks unauthenticated requests to administrative paths.
Apply network ACLs to limit inbound HTTP access to known operator IP ranges until patches are deployed.
Disable or firewall any non-essential WebCenter Sites endpoints that are not required for production traffic.

bash

# Example: restrict WebCenter Sites admin paths at an Nginx reverse proxy
location /cs/ {
    allow 10.10.0.0/16;     # internal management network
    deny all;
    proxy_pass http://webcenter-backend;
}