Oracle E-Business Suite CVE-2026-46923

Exploitation requires the attacker to already hold high application privileges (PR:H) on an Oracle E-Business Suite instance running the Public Sector Financials (International) module, versions 12.2.3-12.2.15, and to reach the application tier over HTTP (AV:N). No user interaction is needed (UI:N), but Oracle rates it difficult to exploit (AC:H), implying additional non-trivial preconditions such as specific state, timing, or configuration in the Authorization component that raise the practical bar. Limiting factors: an unprivileged or anonymous attacker cannot exploit this due to the high-privilege requirement; the high attack complexity makes reliable exploitation hard; and exposure is confined to deployments that actually license and enable this niche public-sector module.

The CVSS 3.1 base score is 8.0 (High) with vector AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. Two factors materially reduce real-world risk: AC:H (Oracle explicitly calls it 'difficult to exploit') and PR:H, meaning the attacker must already hold high privileges within the application. These barriers make opportunistic mass exploitation unlikely, consistent with the absence of a POC and its absence from CISA KEV. Counterbalancing this, the scope change (S:C) and full C:H/I:H/A:H impacts mean success yields complete takeover that can spill into additional products, so consequences are severe even if likelihood is low. No EPSS score was supplied in the input, so exploitation probability cannot be quantified - this gap should be noted rather than assumed low. Net: a genuine high-severity issue for the specific deployments running this module, but not an emergency for the general population given the privilege and complexity prerequisites.

A malicious or compromised insider - or an external attacker who has already obtained high-privilege application credentials - sends crafted HTTP requests to the Public Sector Financials (International) authorization logic and, after overcoming the difficult exploitation conditions, subverts access controls to take over the module and pivot into connected Oracle E-Business Suite products. No public proof-of-concept is known, so an attacker would need to develop the exploit independently.