What is the CVSS score of CVE-2026-46931?

CVE-2026-46931 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-46931?

Oracle Enterprise Asset Management within E-Business Suite versions 12.2.6 through 12.2.15 is vulnerable to account takeover that could grant attackers full control of the Internal Operations…

How to fix or mitigate CVE-2026-46931?

Within 24 hours: Inventory all Oracle EBS 12.2.6-12.2.15 instances; document network exposure and enable enhanced authentication logging on all affected systems. Within 7 days: Implement firewall rules restricting EBS Internal Operations access to trusted administrative networks only; audit and minimize low-privilege account access; establish real-time alerts for authentication anomalies and failed login attempts. Within 30 days: Contact Oracle Support for CVE-2026-46931 hardening guidance; evaluate upgrade path to EBS 12.2.16 or later if released; document and operationalize compensating controls as interim protection.

Oracle E-Business Suite CVE-2026-46931

EUVD-2026-37247 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Enterprise Asset Management Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

HTTP-reachable EBS endpoint exploitable by any authenticated low-privilege user with no interaction, yielding full module takeover, matches Oracle's vector.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:05 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.6-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Asset Management. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Asset Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle Enterprise Asset Management (Oracle E-Business Suite 12.2.6 through 12.2.15) allows a low-privileged remote attacker to fully compromise the Internal Operations component over HTTP. The flaw carries a CVSS 3.1 base score of 8.8 with high confidentiality, integrity, and availability impacts, and no public exploit identified at time of analysis. Because EBS instances frequently underpin manufacturing and asset-management workflows for large enterprises, successful exploitation could pivot from a foothold account into a full module takeover.

Technical ContextAI

The affected component is the Internal Operations module of Oracle Enterprise Asset Management (eAM), a maintenance-management application that ships as part of the Oracle E-Business Suite 12.2.x application tier (CPE: cpe:2.3:a:oracle_corporation:oracle_enterprise_asset_management). EBS 12.2 runs on a multi-tier Fusion Middleware/WebLogic stack that exposes HTTP-based servlets and OA Framework pages to authenticated users; vulnerabilities in this layer typically stem from insufficient authorization enforcement or input handling within Java-based business components. Oracle does not publish a CWE for Critical Patch Update entries, so the precise weakness class (e.g., access control bypass, injection, deserialization) is not disclosed in the available data.

RemediationAI

Apply the patch from the Oracle Critical Patch Update June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html), which is the patch available per vendor advisory for Enterprise Asset Management on E-Business Suite 12.2.6-12.2.15; Oracle publishes per-version patch IDs in the CPU advisory matrix, so administrators should consult that matrix to select the correct 12.2.x bundle. Until the CPU can be applied, restrict network reachability of the EBS application tier - particularly the Enterprise Asset Management responsibilities and Internal Operations URLs - to trusted internal networks via the existing reverse proxy/load balancer, and review the user population assigned EAM responsibilities to remove dormant or over-privileged accounts that satisfy the PR:L precondition. Enable and monitor the EBS Page Access Tracking and Sign-On audit logs for anomalous EAM page access; note that URL filtering at the WebLogic mod_plsql/OA_HTML tier can break legitimate workflows, so test in a staging environment before enforcing in production.