Oracle E-Business Suite CVE-2026-46930

Attacker must be able to reach the HTTPS interface of an Oracle E-Business Suite 12.2.12-12.2.15 deployment that has the Oracle In-Memory Cost Management for Discrete Industries product installed and its Internal Operations component exposed; no credentials, MFA, or user interaction are required (PR:N, UI:N). Exploitation is limited to environments where the EBS application tier is network-reachable by the attacker - installations that are strictly intranet-only, fronted by URL Firewall rules denying Internal Operations paths, or that do not license/deploy the In-Memory Cost Management for Discrete Industries module are not exploitable. The vulnerability does not yield availability impact (A:N), so attackers cannot directly crash the service through this flaw.

All available signals point to a genuinely high-priority issue: CVSS 3.1 9.1 with AV:N, AC:L, PR:N and UI:N means the vulnerability is remotely reachable, low-complexity, unauthenticated, and requires no user interaction, while C:H/I:H reflects total compromise of the product's data. A:N indicates availability is not directly impacted, so it is a data-integrity/confidentiality threat rather than a denial-of-service one. EPSS, KEV, SSVC and POC data were not provided in the input, so widespread mass exploitation cannot be asserted, but the combination of EBS being internet-exposed in many enterprises, an 'Authentication Bypass' tag, and Oracle's own description of 'Easily exploitable' make this a strong candidate for prioritization ahead of EPSS data becoming available. No public exploit identified at time of analysis.

An external attacker who can reach the Oracle E-Business Suite HTTPS endpoint sends a crafted request to the Internal Operations interface of the In-Memory Cost Management for Discrete Industries module without supplying valid credentials, abusing the missing authentication/authorization check implied by CVSS PR:N and the 'Authentication Bypass' tag. They then read, alter, or delete cost-management records - for example tampering with standard costs or inventory valuation data - to commit financial fraud or sabotage enterprise costing. No public exploit identified at time of analysis, but the AC:L/UI:N profile means weaponization is straightforward once a request signature becomes known.