Oracle E-Business Suite CVE-2026-46823

Exploitation requires a reachable Oracle E-Business Suite deployment running the Public Sector Financials (International) module on versions 12.2.6 through 12.2.15, network HTTPS access to the EBS application tier, and a valid low-privileged EBS user account (PR:L) - pure unauthenticated exploitation is not indicated by the CVSS vector despite the 'Authentication Bypass' tag in the input. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once an attacker holds any EBS credentials and network reachability, no further victim action or special timing is needed. Limiting factors include: organizations that do not license or deploy the Public Sector Financials (International) module are not exposed, deployments where the EBS application tier is not internet-facing significantly reduce attacker reach, and impact is confidentiality-only so the vulnerability cannot directly be used to modify financial data or cause denial of service.

The CVSS 3.1 score of 7.7 is driven by network attack vector, low complexity, low privileges, no user interaction, scope change, and high confidentiality impact with no integrity or availability impact (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) - meaning any authenticated EBS user, including very low-privileged ones, can read sensitive data they should not access. No EPSS score was provided in the input, the CVE is not listed in CISA KEV, and no public proof-of-concept was indicated, so the practical exploitation likelihood is currently unknown but not confirmed as actively exploited. The combination of 'easily exploitable' language from Oracle plus PR:L (any low-privileged account suffices) plus scope change makes this a meaningful priority for organizations running EBS 12.2.x in public-sector contexts, even though confidentiality-only impact and the requirement of a valid EBS account limit it below an unauthenticated RCE. The 'Authentication Bypass' tag supplied with the input partially conflicts with the CVSS vector (PR:L implies authentication is required, not bypassed) - defenders should treat this as an authorization bypass rather than an authentication bypass and verify against the Oracle advisory.

A contractor or low-privileged internal user with any valid Oracle E-Business Suite account authenticates over HTTPS to the EBS application tier and invokes a crafted request against the Public Sector Financials (International) module, causing the Authorization component to grant access to data the account should not see. Because the CVSS scope is changed, the unauthorized read can extend to data managed by other components of the EBS deployment, potentially exposing financial records, vendor data, or personally identifiable information of citizens and employees. No public exploit identified at time of analysis, so an attacker would need to develop the request pattern from the advisory and product knowledge.