Oracle E-Business Suite CVE-2026-46916

Requires (1) network HTTP reachability to the Oracle E-Business Suite 12.2 application tier hosting the Oracle Process Manufacturing Product Development module, (2) valid credentials for any low-privileged EBS application user (PR:L - unauthenticated exploitation is NOT in scope per the CVSS vector), and (3) the target running OPM Product Development version 12.2.3 through 12.2.15 with the Quality Management Specs component deployed and accessible. Limiting factors: deployments that expose EBS only on internal networks, enforce MFA on EBS logins, or have not licensed/installed the OPM Product Development module are not exploitable; no user interaction is needed (UI:N) and attack complexity is Low (AC:L), so once a low-privileged account is obtained exploitation is straightforward.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 8.8 and aligns with Oracle's own 'easily exploitable' wording - any holder of a low-privileged EBS application account that can reach the OPM Quality Management Specs endpoints over HTTP can fully compromise the module without user interaction. There is no EPSS score, SSVC decision, or KEV entry provided, and no public proof-of-concept has surfaced, so real-world exploitation pressure today appears lower than the raw 8.8 suggests; however, Oracle EBS is a historically high-value target with credential-spray and insider risk, and the PR:L requirement is a weak barrier in large EBS tenant populations. Conflicting-signal note: the description says 'takeover of Oracle Process Manufacturing Product Development' (a single product) yet C/I/A are all High with Scope:Unchanged, so blast radius is likely limited to OPM/EBS data and workflows rather than the underlying OS - defenders should treat this as a high-priority EBS-internal compromise risk rather than an internet-edge RCE.

An attacker phishes or sprays credentials for any low-privileged Oracle EBS application account, authenticates to the EBS portal, and navigates (or directly POSTs) to an OPM Quality Management Specs HTTP endpoint that fails to enforce authorization, then issues crafted requests that modify or read OPM specs and pivot to full takeover of the OPM Product Development module - manipulating quality specifications, formulas, or test records. No user interaction with a victim is required (UI:N), and no public exploit identified at time of analysis, but the AC:L/PR:L profile makes this realistic for any insider or attacker who obtains one set of EBS credentials.