CVE-2026-46809: Oracle WebCenter Sites Auth Bypass Flaw

CVE-2026-46809 Overview

CVE-2026-46809 is a critical access control vulnerability in Oracle WebCenter Sites, a component of Oracle Fusion Middleware. The flaw allows an unauthenticated attacker with network access via HTTP to compromise affected installations. Successful exploitation grants unauthorized creation, deletion, or modification access to critical data, along with unauthorized read access to all WebCenter Sites accessible data.

Oracle disclosed the issue in the June 2026 Critical Patch Update. The vulnerability is mapped to [CWE-284: Improper Access Control] and affects supported versions 12.2.1.4.0 and 14.1.2.0.0.

Critical Impact
Unauthenticated remote attackers can read, modify, or delete all data accessible to Oracle WebCenter Sites over HTTP without user interaction.

Affected Products

Oracle WebCenter Sites 12.2.1.4.0
Oracle WebCenter Sites 14.1.2.0.0
Oracle Fusion Middleware (WebCenter Sites component)

Discovery Timeline

2026-06-17 - CVE-2026-46809 published to NVD
2026-06-17 - Oracle Critical Patch Update Advisory (cspujun2026) released
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-46809

Vulnerability Analysis

The vulnerability resides in the WebCenter Sites component of Oracle Fusion Middleware. Oracle describes the flaw as easily exploitable, requiring only network access over HTTP. No authentication, privileges, or user interaction are required to trigger the condition.

Attack complexity is low, and the scope remains unchanged. Confidentiality and integrity impacts are rated high, while availability is not affected. The result is full read and write access to data managed by the WebCenter Sites instance.

The EPSS probability is approximately 0.425% at the 33.9 percentile as of 2026-06-18. Public exploit code is not currently available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The weakness is classified under [CWE-284: Improper Access Control]. WebCenter Sites fails to enforce required authorization checks on one or more HTTP-accessible operations. Requests that should be restricted to authenticated administrators are processed without verifying the caller's identity or privileges.

This category of flaw typically stems from missing server-side enforcement on sensitive endpoints, reliance on client-side controls, or inconsistent permission checks across handlers.

Attack Vector

Exploitation occurs over the network using standard HTTP requests directed at an exposed WebCenter Sites instance. An attacker sends crafted requests to vulnerable endpoints to read, create, modify, or delete content stored within the platform.

Because WebCenter Sites is commonly deployed as an internet-facing content management system, instances reachable from untrusted networks are at the highest risk. Internal deployments accessible from compromised user workstations are also exposed.

No proof-of-concept code has been published. Technical specifics are described in prose because no verified exploit artifacts are available. Refer to the Oracle Critical Patch Update Advisory for vendor guidance.

Detection Methods for CVE-2026-46809

Indicators of Compromise

Unexpected creation, modification, or deletion of content assets, templates, or site configurations in WebCenter Sites audit logs.
HTTP requests to WebCenter Sites endpoints originating from unauthenticated sessions or unusual source IP ranges.
New or altered administrative content where no corresponding authenticated editor session exists.
Outbound connections from the WebCenter Sites host to unknown infrastructure shortly after suspicious HTTP traffic.

Detection Strategies

Compare WebCenter Sites application logs against authentication logs to identify content changes lacking a valid session.
Inspect web server and reverse proxy logs for repeated requests to administrative or content-management URLs from a single source.
Baseline normal editor activity hours and flag content mutations occurring outside expected windows.

Monitoring Recommendations

Forward Oracle WebCenter Sites, application server, and front-end web server logs to a centralized analytics platform for correlation.
Enable verbose audit logging for content creation, update, and delete operations within WebCenter Sites.
Alert on HTTP 2xx responses to administrative endpoints from source addresses outside approved management networks.

How to Mitigate CVE-2026-46809

Immediate Actions Required

Apply the patches included in the Oracle June 2026 Critical Patch Update to all WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 instances.
Inventory all internet-exposed WebCenter Sites deployments and prioritize them for patching first.
Review audit logs from before the patch date for evidence of unauthorized content changes.
Rotate administrative credentials and API keys associated with WebCenter Sites after patching.

Patch Information

Oracle has released fixes as part of the June 2026 Critical Patch Update. Administrators should consult the Oracle Critical Patch Update Advisory for the specific patch identifiers and installation prerequisites for versions 12.2.1.4.0 and 14.1.2.0.0.

Workarounds

Restrict HTTP access to WebCenter Sites administrative paths to trusted management networks using a web application firewall or reverse proxy.
Place WebCenter Sites behind a VPN or zero-trust gateway until patches are validated and deployed.
Disable any non-essential WebCenter Sites endpoints that are externally reachable.

bash

# Example reverse proxy restriction for WebCenter Sites admin paths (nginx)
location ~* ^/(cs|Satellite|sites/contentserver)/ {
    allow 10.0.0.0/8;
    deny  all;
    proxy_pass http://webcenter_sites_backend;
}