Oracle E-Business Suite CVE-2026-46918

Network HTTP/HTTPS reachability to an Oracle E-Business Suite 12.2.3-12.2.15 middle tier that has the Process Manufacturing Product Development module (Internal Operations sub-component) deployed and enabled, plus valid credentials for any low-privileged EBS application user (PR:L) - no administrator role, no user interaction, and no specific browser or client configuration are required. Exploitation is LIMITED by the need for a working application-tier account (so fully isolated EBS instances behind VPN with strict account provisioning are harder to hit) and by whether OPM is licensed and provisioned on the target - pure Financials-only EBS installs that have not deployed the Process Manufacturing product family are not exposed. The CVSS S:C flag means a successful exploit additionally requires the EBS middle tier to share trust with other modules, which is the default deployment topology.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H yields 9.9 - among the highest scores Oracle issues - because exploitation needs only network access and any low-privileged EBS account, requires no user interaction, and produces a scope change with full CIA impact on neighboring modules. Real-world risk is shaped strongly by exposure: many EBS 12.2 deployments are intranet-facing, which lowers the practical attack surface, but any organisation that exposes EBS to the internet or to a large internal user base should treat this as priority-one. EPSS, KEV, SSVC, and public POC data are all absent from the supplied intelligence, so there is no current evidence of in-the-wild exploitation; however, EBS CPU advisories are routinely reverse-engineered within weeks of release, so the window before exploit code appears is typically short. The single Oracle advisory is the only source - no third-party confirmation of root cause or independent CVSS recomputation was available.

An attacker who has obtained or been granted any low-privileged EBS account - for example a self-service HR user, a contractor, or a credential harvested via phishing - sends a crafted HTTP request to the Process Manufacturing Product Development endpoint on the EBS middle tier. Because the bug carries a CVSS scope change, the request takes over the OPM component and lets the attacker pivot to read or modify data in other EBS modules sharing the same APPS schema, such as Financials or Supply Chain. No public exploit identified at time of analysis, but Oracle classifies exploitation as 'easy', so a working POC is likely to surface after the CPU is reverse-engineered.