What is the CVSS score of CVE-2026-46918?

CVE-2026-46918 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-46918?

Oracle E-Business Suite's Process Manufacturing Product Development module (versions 12.2.3-12.2.15) is vulnerable to account takeover by authenticated remote attackers, enabling privilege escalation…

How to fix or mitigate CVE-2026-46918?

Within 24 hours: Inventory all E-Business Suite installations and identify Process Manufacturing module users; escalate to Oracle support for patch timeline and formal advisory; draft stakeholder communication. Within 7 days: Implement network segmentation to restrict E-Business Suite-to-other-Oracle-system communication; enable enhanced audit logging on module access and privilege changes; restrict module access to essential personnel only. Within 30 days: Apply vendor patch to all affected versions immediately upon release; conduct forensic review of audit logs for unauthorized access; reset credentials for high-privilege E-Business Suite accounts; validate cross-system communication logs for anomalies.

Oracle E-Business Suite CVE-2026-46918

EUVD-2026-37236 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Process Manufacturing Product Development Oracle Corporation

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Remote HTTP exploitation with any low-privileged EBS account, no user interaction, scope change into other modules, and full takeover yields PR:L, S:C and C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:11 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Product Development. While the vulnerability is in Oracle Process Manufacturing Product Development, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Process Manufacturing Product Development. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle E-Business Suite's Process Manufacturing Product Development component (versions 12.2.3 through 12.2.15) allows a low-privileged remote attacker to fully compromise the module via HTTP and pivot into other Oracle products through a CVSS scope change. Oracle rates the issue 9.9/10 and describes it as easily exploitable; no public exploit identified at time of analysis and the CVE is not on the CISA KEV list.

Technical ContextAI

Oracle Process Manufacturing (OPM) Product Development is a recipe, formulation, and laboratory-management module within the Oracle E-Business Suite 12.2 line, exposed through the standard EBS Internet/Forms HTTP front end (Oracle HTTP Server / WebLogic / Forms). The CPE cpe:2.3:a:oracle_corporation:oracle_process_manufacturing_product_development confirms the affected component, and the 'Internal Operations' sub-component plus the scope-change flag (S:C) indicate the flaw lets the attacker break out of OPM's security boundary into adjacent EBS modules that share the same middle tier and database schema. No CWE was assigned by Oracle (consistent with their CPU disclosure style), but the combination 'low-privileged HTTP request → full takeover + scope change' is characteristic of an authorization/access-control bypass or unsafe operation exposure in an authenticated EBS servlet rather than a memory-corruption bug.

RemediationAI

Apply the patch available per Oracle's June 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspujun2026.html); released patched versions are not independently confirmed in the supplied data, so consult the CPU matrix for the exact EBS 12.2 patchset and one-off patch numbers that cover the Process Manufacturing Product Development component on your current 12.2.3-12.2.15 baseline. Until patches can be applied, restrict network reachability of the EBS middle tier so that only trusted internal users can reach it (firewall the Oracle HTTP Server / WebLogic managed servers from the internet and from untrusted VLANs), and use the EBS URL Firewall / DMZ configuration to whitelist only the responsibilities and JSP/Forms paths your business actually uses - note this can break legitimate self-service flows for users who reach blocked URLs. Tighten function-security and responsibility assignments so that low-privileged accounts cannot reach OPM Product Development forms or servlets, audit and disable dormant low-privilege accounts (a common pivot for PR:L flaws), and increase monitoring on EBS access logs and FND_LOGINS for anomalous access to Process Manufacturing URLs; expect some helpdesk overhead from tightened responsibilities and URL whitelisting.