Oracle iAssets CVE-2026-46822

Exploitation requires (1) a running Oracle E-Business Suite 12.2.3-12.2.15 deployment with the Oracle iAssets module licensed and enabled under the Internal Operations component, (2) network reachability to the EBS web tier over HTTP from the attacker, and (3) a valid low-privileged EBS account (CVSS PR:L) - no user interaction by another party is needed (UI:N). Exploitation is limited by the need for that authenticated session, so deployments where the EBS frontend is segmented from the internet and where iAssets responsibilities are tightly provisioned face a smaller realistic attack surface; conversely, EBS instances exposing iSupplier/iStore/self-service portals to partners materially raise the risk.

Signals are uniformly severe: the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H yields a 9.9 base score, with a scope change indicating impact reaches beyond iAssets into surrounding EBS products - a meaningful escalation factor for typical EBS deployments where iAssets shares infrastructure with Financials, HR, and Procurement. PR:L means an authenticated EBS account is required, which lowers the population of attackers but is a low bar in EBS environments where self-service or business-partner accounts are common. EPSS and CISA KEV status are not provided in the input; no public exploit identified at time of analysis. Oracle EBS has a long history of post-CPU exploitation by ransomware and access-broker actors, so the realistic priority is high even without KEV confirmation, particularly for internet-exposed iSupplier/iStore/iAssets front ends.

An attacker who has obtained any low-privileged EBS account (for example through phishing a contractor, reusing a leaked self-service credential, or via a compromised business partner login) reaches the iAssets pages over HTTP/HTTPS and submits crafted requests to an iAssets endpoint. Because of the scope-changing flaw, the request executes with elevated effect on iAssets and adjacent EBS modules, resulting in full iAssets takeover and impact on neighbouring components such as Financials data. No public proof-of-concept has been observed at time of analysis, but EBS CPU advisories are routinely reverse-engineered within days of release.