What is the CVSS score of CVE-2026-46922?

CVE-2026-46922 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle HR Intelligence are affected by CVE-2026-46922?

Oracle HR Intelligence in E-Business Suite versions 12.2.3-12.2.15 can be fully compromised by authenticated high-privileged users, with no public exploit identified at time of analysis.

How to fix or mitigate CVE-2026-46922?

Within 24 hours: Identify and audit all high-privilege accounts accessing HR Intelligence; review recent access logs for anomalous activity. Within 7 days: Restrict HR Intelligence module access to only essential personnel; enforce multi-factor authentication for administrative account access; apply available Oracle Critical Patch Updates for E-Business Suite. Within 30 days: Monitor Oracle advisories for a vendor-released patch to CVE-2026-46922; implement privileged access management (PAM) with session recording; conduct full security assessment of HR module access controls and audit capabilities.

Oracle HR Intelligence CVE-2026-46922

EUVD-2026-37240 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Hr Intelligence Oracle Corporation

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable HTTP endpoint with low complexity, but requires a high-privilege EBS account (PR:H) and no user interaction; full takeover yields C:H/I:H/A:H, scope unchanged.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:09 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle HR Intelligence. Successful attacks of this vulnerability can result in takeover of Oracle HR Intelligence. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle HR Intelligence (component: Internal Operations) in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by an authenticated high-privileged user over the network via HTTP, leading to takeover of the HR Intelligence module with full confidentiality, integrity, and availability impact. The flaw was reported by Oracle and disclosed in the June 2026 Critical Patch Update; there is no public exploit identified at time of analysis and the issue is not on CISA KEV. CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting easy exploitation once the high privilege precondition is met.

Technical ContextAI

Oracle HR Intelligence is a packaged analytics/reporting module within the Oracle E-Business Suite (EBS) HR product family, delivering HR data warehousing and OLAP-style reporting on top of the Oracle Applications stack (Oracle Application Server, WebLogic-era components, and the EBS schema). The affected CPE 'cpe:2.3:a:oracle_corporation:oracle_hr_intelligence' covers EBS HR Intelligence 12.2.3-12.2.15, which runs inside the standard EBS 12.2 mid-tier and is reached over HTTP through the EBS application gateway. The Internal Operations component typically exposes administrative/internal servlets and configuration endpoints used by privileged users, which is consistent with the PR:H precondition. No CWE was assigned by the source, but the 'takeover' wording combined with full C/I/A impact is consistent with a privilege-abuse or insufficient access-control / unsafe administrative function class of bug rather than a memory-corruption RCE.

RemediationAI

Apply the Oracle Critical Patch Update of June 2026 for Oracle E-Business Suite as documented at https://www.oracle.com/security-alerts/cspujun2026.html; the input does not name a specific patched build, so this is best described as patch available per vendor advisory and administrators should consult the CPU matrix for the exact EBS 12.2 patch bundle covering HR Intelligence. Until the CPU is deployed, restrict network reachability of the EBS Internal Operations endpoints to a small administrative network segment (jump hosts/VPN only), tighten EBS responsibilities so that high-privilege HR Intelligence roles are granted only to a minimum set of named accounts, enforce MFA on those accounts, and increase audit-log review for HR Intelligence administrative actions; note that responsibility tightening can disrupt legitimate HR analytics workflows and network restrictions can break integrations that rely on direct HTTP access to internal endpoints.