What is the CVSS score of CVE-2026-46915?

CVE-2026-46915 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-46915?

Oracle Complex Maintenance, Repair and Overhaul (cMRO) versions 12.2.3-12.2.15 contain a high-severity vulnerability enabling authenticated low-privileged user account takeover with potential lateral…

How to fix or mitigate CVE-2026-46915?

Within 24 hours: Enumerate all cMRO instances in version range 12.2.3-12.2.15 and document dependencies on other Oracle E-Business Suite modules. Within 7 days: Enforce HTTPS-only access via firewall rules, require multi-factor authentication for all cMRO accounts, and implement comprehensive audit logging of administrative and API activity. Within 30 days: Monitor Oracle security advisories for patch availability; plan version upgrade strategy; assess security posture of dependent E-Business Suite applications.

Oracle E-Business Suite CVE-2026-46915

EUVD-2026-37234 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Oracle Oracle Complex Maintenance Repair And Overhaul Authentication Bypass

8.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.5 HIGH

Network HTTP attack surface (AV:N), needs authenticated low-priv EBS account (PR:L), Oracle states difficult to exploit (AC:H), scope change to other EBS products (S:C), full takeover (C/I/A:H).

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:12 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Production). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Complex Maintenance, Repair and Overhaul. While the vulnerability is in Oracle Complex Maintenance, Repair and Overhaul, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Complex Maintenance, Repair and Overhaul. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Takeover of Oracle Complex Maintenance, Repair and Overhaul (cMRO) versions 12.2.3 through 12.2.15 is achievable by a low-privileged attacker over HTTP, with the scope changing to impact additional Oracle E-Business Suite products beyond cMRO itself. The high CVSS 3.1 score of 8.5 reflects full confidentiality, integrity, and availability impact, though high attack complexity tempers exploitability. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain low-privileged EBS credentials

Delivery

Reach cMRO HTTP endpoint

Exploit

Craft request meeting complex preconditions

Execution

Trigger cross-scope flaw in Production component

Persist

Pivot impact to adjacent EBS modules

Impact

Take over cMRO and affected products

Access

Obtain low-privileged EBS credentials

Delivery

Reach cMRO HTTP endpoint

Exploit

Craft request meeting complex preconditions

Execution

Trigger cross-scope flaw in Production component

Persist

Pivot impact to adjacent EBS modules

Impact

Take over cMRO and affected products

Vulnerability AssessmentAI

Exploitation	Exploitation requires (1) network reachability to the Oracle E-Business Suite HTTP tier where the Complex Maintenance, Repair and Overhaul module is deployed, (2) valid low-privileged authenticated credentials to Oracle EBS with at least minimal cMRO-related responsibility (PR:L, so anonymous access is not sufficient), and (3) a deployment running cMRO version 12.2.3 through 12.2.15. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals are mixed and lean toward moderate real-world urgency rather than emergency patching. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who has obtained a low-privileged EBS account (via phishing, credential reuse, or insider access) navigates to a cMRO HTTP endpoint and submits a crafted request that abuses the vulnerable code path; due to the Scope:Changed nature of the flaw, the request not only fully compromises cMRO data and configuration but also pivots to affect adjacent EBS components sharing the application tier. Exploitation requires non-trivial knowledge of the cMRO internals (AC:H), so a working chain is more likely from a targeted adversary than from an off-the-shelf tool.
Remediation	Apply the fixes delivered in the Oracle Critical Patch Update of June 2026 as documented at https://www.oracle.com/security-alerts/cspujun2026.html; patch available per vendor advisory, but a single tagged fix version is not independently confirmed in the input data - administrators should consult the CPU patch matrix to identify the cMRO bundle patch that corresponds to their 12.2.x baseline and apply it through adop/AutoConfig. … Detailed patch versions, workarounds, and compensating controls in full report.