External risk intelligence

Oracle WebCenter Sites Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-46797

A critical vulnerability exists in Oracle WebCenter Sites that allows an unauthenticated attacker with network access to take over the system, impacting confidentiality, integrity, and availability. Organizations using this product should confirm its presence and exposure to external networks.

Oracle Webcenter Sites

12.2.1.4.014.1.2.0.0

Halo Surface Signal

Likely · external exposure

4Halo Surface Signal

Oracle WebCenter Sites is a web-based content management platform typically deployed as a public-facing or externally accessible web application to serve content or manage digital assets, making it reachable from the internet in common deployment patterns.

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in Oracle WebCenter Sites, a content management product. The issue allows an unauthenticated attacker with network access to potentially take over the entire system, impacting confidentiality, integrity, and availability. The main concern is confirming if this specific Oracle product is used within the organization and if it is exposed to external networks.

  • Attackers could fully control affected Oracle content systems.
  • Critical issue impacts widely used web content management.
  • Confirm if this Oracle product is in use and exposed.

Attack Path

How an attacker could exploit the issue

An attacker could gain control of Oracle WebCenter Sites without needing any credentials by sending specially crafted network requests. This is possible because the vulnerable component is exposed over HTTP and does not require prior authentication or user interaction. Successfully exploiting this vulnerability allows an attacker to completely take over the affected Oracle WebCenter Sites instance.

  • Attacker needs network access.
  • No authentication required to trigger.
  • Complete system takeover possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker with network access to fully compromise Oracle WebCenter Sites, potentially leading to a complete takeover of the system. This could affect the confidentiality, integrity, and availability of the web content management platform and its associated data.

  • System takeover of Oracle WebCenter Sites.
  • Attacker exploits unauthenticated network access.
  • Complete loss of system control and data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Oracle WebCenter Sites could allow an unauthenticated attacker to take over the system. Initial triage should focus on identifying all instances of Oracle WebCenter Sites, confirming their reachability and business criticality, and then locating the accountable application or platform owner to plan remediation.

  • Application owners should manage the issue.
  • Verify external reachability and business impact.
  • Plan remediation based on confirmed risk.

Supplementary metadata

PCI scan relevance

Yes

CVE-2026-46797 — Halo PCI Relevance: Yes. Under typical PCI ASV external scan criteria, this issue may be flagged for scan prioritization.

This Oracle WebCenter Sites vulnerability allows unauthenticated attackers to take over the system, which would cause a PCI scan failure.

Scan-prioritization guidance only—not a PCI DSS certification or ASV attestation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle WebCenter Sites?

Oracle WebCenter Sites is a web-based content management platform used by organizations to manage digital marketing, web content, and online customer experiences. It acts as a central hub for publishing and serving digital assets to users.

What does CWE-284 mean for CVE-2026-46797?

CWE-284 classifies this vulnerability as an Improper Access Control issue. In the context of this CVE, it means the software fails to properly verify or restrict permissions, allowing an unauthenticated person to interact with functions they should not have access to.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by sending specifically crafted HTTP requests to the target system. Because the system lacks proper authentication checks, no login credentials or prior user interaction are needed to initiate the attack. Requests made from within a restricted or local network that cannot reach the application do not trigger this specific issue.

Do I need to worry if my instance is internal?

Halo Surface Signal notes that WebCenter Sites is frequently deployed as a public-facing application, increasing the risk. While internet-facing instances are most at risk, you should verify if your instance is accessible via any network an attacker could reach, as the vulnerability relies on simple network-based access.

When should I begin responding to this CVE?

You should start by identifying all deployments of Oracle WebCenter Sites within your environment immediately. Once identified, confirm the network reachability of each instance and coordinate with the application owners to plan for the necessary security updates.

References

Sources and related resources

Primary sources: NVD, CVE.org.

NVDPublished