Oracle E-Business Suite CVE-2026-46915

Exploitation requires (1) network reachability to the Oracle E-Business Suite HTTP tier where the Complex Maintenance, Repair and Overhaul module is deployed, (2) valid low-privileged authenticated credentials to Oracle EBS with at least minimal cMRO-related responsibility (PR:L, so anonymous access is not sufficient), and (3) a deployment running cMRO version 12.2.3 through 12.2.15. Exploitation is limited by high attack complexity (AC:H) - Oracle's own classification states the vulnerability is 'difficult to exploit,' implying the attacker must satisfy additional non-trivial conditions such as race windows, specific data states, or precise request crafting beyond a single HTTP call. No user interaction is required (UI:N).

Signals are mixed and lean toward moderate real-world urgency rather than emergency patching. CVSS 3.1 of 8.5 is driven primarily by Scope:Changed combined with High C/I/A impact, but AC:H (high attack complexity) and PR:L (some authentication required) significantly reduce drive-by exploitability - this is not an unauthenticated RCE. No EPSS score was supplied in the input, the CVE is not in CISA KEV, and no public POC has been observed, so widespread opportunistic exploitation is unlikely in the near term. The realistic risk profile is a skilled adversary who already has an EBS user account (insider, phished credential, or chained from another EBS bug) leveraging this to escalate impact across modules; organizations running cMRO in regulated industries (aerospace, defense MRO) should treat it as a high-priority quarterly patch but not a fire-drill out-of-band fix.

An attacker who has obtained a low-privileged EBS account (via phishing, credential reuse, or insider access) navigates to a cMRO HTTP endpoint and submits a crafted request that abuses the vulnerable code path; due to the Scope:Changed nature of the flaw, the request not only fully compromises cMRO data and configuration but also pivots to affect adjacent EBS components sharing the application tier. Exploitation requires non-trivial knowledge of the cMRO internals (AC:H), so a working chain is more likely from a targeted adversary than from an off-the-shelf tool.