Oracle E-Business Suite CVE-2026-46931

Exploitation requires (1) network HTTP/HTTPS reachability to an Oracle E-Business Suite 12.2.6-12.2.15 application tier running the Oracle Enterprise Asset Management module with the Internal Operations component deployed, and (2) a valid low-privileged EBS user account (PR:L) - fully unauthenticated exploitation is not in scope per the CVSS vector. No user interaction is required (UI:N) and attack complexity is low (AC:L), so any authenticated user with HTTP access to the EBS instance can attempt it; the main limiting factors are the authentication requirement and that EBS deployments not running the Enterprise Asset Management module, or running versions outside 12.2.6-12.2.15, are not affected.

All available signals point to a meaningful but not headline-grade risk. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates network-reachable, low-complexity exploitation by any authenticated EBS user with no user interaction, with high impact across the CIA triad - Oracle itself characterizes it as 'easily exploitable'. There is no CISA KEV listing, no EPSS score in the supplied data, and no public exploit identified at time of analysis, so this is not yet confirmed mass-exploited; however, EBS is a recurring target for opportunistic and ransomware actors after Oracle CPU disclosures, and historic Oracle CPU bugs have been weaponized within weeks of patch release. The required PR:L is the main tempering factor: an attacker needs a valid EBS account, which is realistic in large multi-tenant deployments with thousands of internal/contractor users but blocks fully unauthenticated internet exploitation.

A contractor or compromised low-privilege EBS user logs into the E-Business Suite application tier over HTTP/HTTPS, navigates to or directly requests an Internal Operations endpoint within Enterprise Asset Management, and submits a crafted parameter that abuses the underlying flaw to obtain full module control. With high C/I/A impact, the attacker can then read sensitive maintenance and asset records, alter work orders or master data, and disrupt EAM operations. No public exploit identified at time of analysis, but Oracle's 'easily exploitable' wording typically signals that reverse-engineering the June 2026 CPU patch will yield a working exploit quickly.