What is the CVSS score of CVE-2026-46923?

CVE-2026-46923 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-46923?

Oracle E-Business Suite's Public Sector Financials module (versions 12.2.3-12.2.15) contains a critical authorization flaw enabling complete system takeover with potential spread to connected…

How to fix or mitigate CVE-2026-46923?

Within 24 hours: inventory all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15 with the Public Sector Financials module and immediately restrict HTTP network access to the Authorization component via firewall rules, limiting traffic to essential administrative users only. Within 7 days: audit all high-privileged accounts accessing the module, review authentication logs for suspicious access patterns, enforce multi-factor authentication for privileged users, and contact Oracle support for interim mitigation recommendations and patch status. Within 30 days: implement comprehensive transaction logging for the Authorization component, establish weekly access reviews of privileged accounts, develop an upgrade plan to unaffected Oracle E-Business Suite versions once vendor guidance is available, and conduct post-remediation security validation.

Oracle E-Business Suite CVE-2026-46923

EUVD-2026-46460 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-4jg4-q966-gm2j

Authentication Bypass Oracle Oracle Public Sector Financials International Oracle Corporation

8.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.0 HIGH

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Network HTTP access (AV:N) but attacker needs high app privileges (PR:H) and Oracle rates it difficult (AC:H); scope change and full takeover justify S:C with C/I/A all High.

3.1 AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:10 vuln.today

CVE Published

Jul 21, 2026 - 21:32 cve.org

HIGH 8.0

DescriptionCVE.org

Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component: Authorization). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Public Sector Financials (International). While the vulnerability is in Oracle Public Sector Financials (International), attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Public Sector Financials (International). CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full compromise (takeover) of the Oracle Public Sector Financials (International) module in Oracle E-Business Suite is possible via its Authorization component, affecting supported versions 12.2.3 through 12.2.15. A high-privileged attacker with network access over HTTP can, under difficult-to-exploit conditions, breach the module and, because of a scope change, significantly impact additional connected products. There is no public exploit identified at time of analysis and the issue is not on CISA KEV.

Technical ContextAI

The flaw resides in the Authorization component of the Oracle Public Sector Financials (International) product, part of the Oracle E-Business Suite ERP platform (CPE cpe:2.3:a:oracle_corporation:oracle_public_sector_financials_(international)). Oracle E-Business Suite is a Java/Oracle-DB-backed web application accessed over HTTP, and authorization defects in this layer typically allow an authenticated privileged user to bypass or abuse access-control checks. No CWE was assigned in the input, but the tag 'Information Disclosure' combined with C:H/I:H/A:H impacts and the 'takeover' language points to a broken-authorization / privilege-boundary weakness class where existing high privileges are leveraged beyond their intended scope.

RemediationAI

Patch available per vendor advisory: apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to all E-Business Suite 12.2.3-12.2.15 instances running the Public Sector Financials (International) module; Oracle does not publish individual fixed build numbers outside the CPU, so the CPU patch level itself is the fix reference. Until the CPU is applied, reduce exposure by restricting HTTP access to the E-Business Suite application tier to trusted internal networks and VPNs, tightening application role and responsibility assignments so fewer users hold the high privileges required to exploit this (PR:H), and increasing audit logging on the Authorization component and privileged financial transactions to detect abuse. Note that network restriction may disrupt remote or partner access and tighter role review can interrupt legitimate administrative workflows, so validate changes in a test instance first.