What is the CVSS score of CVE-2026-46927?

CVE-2026-46927 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-46927?

Oracle Receivables in E-Business Suite versions 12.2.3-12.2.15 is vulnerable to unauthenticated remote takeover through the Internal Operations SOAP interface, exposing confidential financial data…

How to fix or mitigate CVE-2026-46927?

Within 24 hours: Identify all Oracle E-Business Suite instances running versions 12.2.3-12.2.15 and assess network exposure to the SOAP interface. Within 7 days: Implement network segmentation to restrict untrusted access to the Internal Operations SOAP interface via firewall rules or VPC isolation, and enable detailed logging on receivables transactions. Within 30 days: Execute upgrade to Oracle E-Business Suite version 12.2.16 or later, or migrate receivables functions to a patched alternative system.

Oracle E-Business Suite CVE-2026-46927

EUVD-2026-37243 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Receivables Oracle Corporation

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

SOAP endpoint is network-reachable (AV:N) with no auth or user interaction (PR:N/UI:N); Oracle's AC:H reflects non-trivial conditions; description states full takeover (C:H/I:H/A:H).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:07 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Receivables product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle Receivables. Successful attacks of this vulnerability can result in takeover of Oracle Receivables. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle Receivables in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible by unauthenticated attackers reaching the SOAP interface of the Internal Operations component. Oracle's CVSS 3.1 score of 8.1 reflects full confidentiality, integrity, and availability impact, though high attack complexity (AC:H) tempers the practical risk. No public exploit identified at time of analysis, and the issue is not on CISA KEV.

Technical ContextAI

Oracle E-Business Suite (EBS) is a large enterprise resource planning suite; Oracle Receivables is its accounts-receivable module, used for invoicing, customer balances, and collections. The vulnerability sits in the Internal Operations component and is reached through a SOAP web service endpoint, which in EBS is typically exposed via the Oracle Application Server / WebLogic tier and the Integrated SOA Gateway. Oracle did not publish a CWE for this issue, but the combination of SOAP transport, AC:H complexity, and full C/I/A impact is consistent with a deserialization, XML/SOAP parsing, or authorization-bypass class of flaw in a web service handler. CPE data confirms the affected product is cpe:2.3:a:oracle_corporation:oracle_receivables across all listed versions in the 12.2.x branch.

RemediationAI

Apply the patches in the Oracle Critical Patch Update of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html), which is the authoritative fix referenced by the advisory; the input does not provide an exact patch-set bundle number, so consult that CPU matrix for the precise Oracle Receivables 12.2.x patch that corresponds to your installed version. Until patching is complete, restrict network reachability of the EBS SOAP / Integrated SOA Gateway endpoints to trusted internal segments using firewall or reverse-proxy rules, and disable any unused SOAP services in the Internal Operations component via the Integrated SOA Gateway admin UI - be aware this can break integrations that legitimately consume those services. Place the EBS web tier behind authenticated reverse proxy or WAF rules that drop unauthenticated SOAP requests to Receivables endpoints, accepting that this may interfere with B2B or partner integrations and will require careful allowlisting.