External risk intelligence

Oracle WebCenter Portal Unauthenticated Network Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-46846

A critical vulnerability exists in Oracle WebCenter Portal, allowing unauthenticated attackers with network access to potentially take over the system, impacting its confidentiality, integrity, and availability, as well as other connected products.

Missing Authentication

Halo Surface Signal

Very likely · external exposure

5Halo Surface Signal

Oracle WebCenter Portal is an enterprise web application platform designed to be accessed over the network via HTTP. Because this vulnerability is unauthenticated and requires only network access to the web portal, it is very likely to be exposed to the public internet in common deployment scenarios.

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle WebCenter Portal, a component of Oracle Fusion Middleware. This issue allows unauthenticated attackers with network access to potentially compromise the system, leading to significant impacts across connected products and a complete takeover of the affected portal. The highest severity score indicates extensive confidentiality, integrity, and availability risks.

  • Attackers can take over the portal remotely.
  • Critical systems are at risk of full compromise.
  • Confirm relevance and assess exposure of Oracle WebCenter Portal.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request over the network to the Oracle WebCenter Portal's Security Framework. No authentication is required, and the attacker can target the system directly via HTTP. If successful, this could lead to a complete takeover of the portal, potentially impacting other connected products.

  • Unauthenticated network access required.
  • Triggers via the Security Framework component.
  • Complete takeover of the portal.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker with network access could potentially take over Oracle WebCenter Portal, impacting its confidentiality, integrity, and availability. This could also affect other products integrated with or impacted by Oracle WebCenter Portal.

  • Oracle WebCenter Portal system data.
  • Attacker gains network access via HTTP.
  • Complete takeover of the portal.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Oracle WebCenter Portal necessitates immediate attention from teams managing enterprise application platforms. Given the exposure via HTTP and the potential for unauthenticated network access, the first practical step involves identifying all instances of Oracle WebCenter Portal, assessing their reachability and business criticality, and then locating the accountable owner to coordinate a risk-based remediation plan.

  • Platform and application owners should lead.
  • Verify network exposure and asset criticality.
  • Plan coordinated remediation based on risk.

Supplementary metadata

PCI scan relevance

Yes

CVE-2026-46846 — Halo PCI Relevance: Yes. Under typical PCI ASV external scan criteria, this issue may be flagged for scan prioritization.

This critical vulnerability in Oracle WebCenter Portal could allow an unauthenticated attacker to compromise the system, likely resulting in a PCI ASV scan failure.

Scan-prioritization guidance only—not a PCI DSS certification or ASV attestation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle WebCenter Portal?

Oracle WebCenter Portal is an enterprise software platform used to create and manage web-based applications, intranets, and customer-facing portals. It acts as a central hub within Oracle Fusion Middleware, integrating content, data, and business applications into a single user interface. Organizations rely on it to provide secure access to web services and personalized information.

How should I understand the CVE-2026-46846 weakness?

This vulnerability is classified as CWE-306, which refers to a failure to perform or correctly enforce authentication for critical functions. In plain terms, the software's security controls do not verify the identity of a user before granting them access to sensitive parts of the system. For CVE-2026-46846, this missing check allows an unauthorized person to interact with the portal as if they were a legitimate user, leading to a complete system takeover.

What triggers the vulnerability in Oracle WebCenter Portal?

The flaw is triggered when an attacker sends a specially crafted request over the network to the Security Framework component of the portal. Because the system fails to require authentication, no valid login or user credentials are necessary to initiate the attack. Simply having network reach to the HTTP service is sufficient to trigger the vulnerability; it does not require an attacker to have prior knowledge of, or access to, the portal's internal user directory.

Is my instance of Oracle WebCenter Portal at risk?

Halo Surface Signal indicates that because this portal is designed to be accessed via HTTP over a network, it is very likely to be reachable from the internet in many deployments. If your instance is exposed to the public internet, it faces a higher level of risk compared to systems isolated within an internal network. You should verify whether your specific portal deployment is accessible externally or if it is restricted to internal users.

What are the first steps to handle CVE-2026-46846?

Start by identifying all instances of Oracle WebCenter Portal within your environment. Once you have a complete inventory, determine which systems are version 12.2.1.4.0 or 14.1.2.0.0, as these are confirmed to be affected. Assess the business criticality and network accessibility of each identified portal. Finally, coordinate with the specific application owners to review the security status of these platforms and prepare for necessary updates or mitigation measures.

References

Sources and related resources

Primary sources: NVD, CVE.org.

NVDPublished