External risk intelligence

Oracle WebCenter Sites Unauthorized Data Access and Modification Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-46809

A critical vulnerability exists in Oracle WebCenter Sites that allows unauthenticated attackers with network access to gain unauthorized control over critical data, including creation, deletion, modification, or complete access. This issue, which is reachable via HTTP, could significantly impact data confidentiality an

Oracle Webcenter Sites

12.2.1.4.014.1.2.0.0

Halo Surface Signal

Likely · external exposure

4Halo Surface Signal

Oracle WebCenter Sites is a web-based content management system typically deployed as a public-facing web application or service to manage website content, making it commonly reachable via the internet.

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability impacts Oracle WebCenter Sites, a platform used for managing web content. The issue could allow unauthorized individuals to access, modify, or delete critical data without needing any credentials, posing a significant risk to data integrity and confidentiality. Determining if your organization utilizes this specific Oracle product is the immediate priority.

  • Unauthenticated attackers can access sensitive data.
  • Content management systems are common targets.
  • Confirm Oracle WebCenter Sites usage.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending network requests to an exposed Oracle WebCenter Sites application. Since no authentication is required, an attacker can directly interact with the vulnerable component, leading to unauthorized data manipulation or access.

  • Unauthenticated network access needed.
  • Vulnerable component exposed to network.
  • Unauthorized data access or modification.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker with network access could compromise Oracle WebCenter Sites, potentially leading to unauthorized modification or complete access to critical data. This could occur when the system is exposed via HTTP.

  • Critical system data could be accessed.
  • Attacker exploits network access via HTTP.
  • Unauthorized data modification or access.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Oracle WebCenter Sites product is affected by this vulnerability, indicating that application owners and platform teams are likely responsible for remediation. The initial step is to identify all instances of Oracle WebCenter Sites within the environment, determine their network exposure, and assess their business criticality. Once these factors are understood, the accountable owner can be identified, and a risk-based remediation plan can be developed, potentially involving coordination with Oracle.

  • Application owners should manage this issue.
  • Verify network reachability and business criticality first.
  • Plan remediation based on identified risks.

Supplementary metadata

PCI scan relevance

Yes

CVE-2026-46809 — Halo PCI Relevance: Yes. Under typical PCI ASV external scan criteria, this issue may be flagged for scan prioritization.

This vulnerability could allow an attacker to bypass authentication, gain unauthorized access to critical data, or modify sensitive information, potentially leading to a PCI ASV scan failure.

Scan-prioritization guidance only—not a PCI DSS certification or ASV attestation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle WebCenter Sites?

Oracle WebCenter Sites is a web-based content management system within Oracle Fusion Middleware. Organizations use it to build, manage, and deliver dynamic website content. Because it functions as a central platform for digital experiences, it often handles large volumes of organizational data and is typically deployed as a web application that remains accessible to users over the network.

What does CWE-284 mean for CVE-2026-46809?

CWE-284 refers to Improper Access Control. In the context of CVE-2026-46809, this means the software fails to properly verify the identity or permissions of a user before granting them access to sensitive data or functions. Because the system lacks these checks, it allows unauthorized individuals to perform actions—like viewing, changing, or deleting critical data—that they should not have been allowed to do in the first place.

How does an attacker trigger this vulnerability?

An attacker triggers this bug by sending specific HTTP network requests to the vulnerable WebCenter Sites application. Since the vulnerability does not require authentication, the system processes these commands without checking if the sender is a legitimate user. It is important to note that this does not require a user to log in or hold a valid account; the vulnerability exists within the application's request-handling logic itself.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates that Oracle WebCenter Sites is often deployed as a public-facing application, making it reachable via the internet. If your instance is accessible from the internet or other untrusted networks, your risk is significantly higher because an attacker does not need internal network access to reach the vulnerable component. You should prioritize checking the network exposure of any instances running versions 12.2.1.4.0 or 14.1.2.0.0.

What steps should I take to respond to this CVE?

Your first step is to inventory your environment to locate all running instances of Oracle WebCenter Sites and confirm their versions. Once identified, evaluate whether these instances are reachable over the network, particularly from the internet. Engage the application owners to assess the business criticality of each instance and coordinate with Oracle’s official security channels to plan and implement the necessary updates.

References

Sources and related resources

Primary sources: NVD, CVE.org.

NVDPublished