What is the CVSS score of CVE-2026-46933?

CVE-2026-46933 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Applications Manager are affected by CVE-2026-46933?

A CRITICAL privilege escalation vulnerability (CVSS 9.9) in Oracle Applications Manager within E-Business Suite versions 12.2.3-12.2.15 allows low-privileged remote attackers to gain full…

How to fix or mitigate CVE-2026-46933?

Within 24 hours: Identify and document all systems running Oracle E-Business Suite versions 12.2.3 through 12.2.15, including their network exposure and role in business processes. Within 7 days: Apply Oracle's June 2026 Critical Patch Update to all affected systems, starting with non-production testing environments. Within 30 days: Verify successful patch deployment across all production systems and validate that the vulnerability is remediated through post-patch security scanning.

Oracle Applications Manager CVE-2026-46933

EUVD-2026-37249 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Applications Manager Oracle Corporation

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable OAM endpoint, low complexity, requires any low-privileged EBS account (PR:L), no user interaction, and the vendor-confirmed scope change yields full C/I/A impact on adjacent components.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:04 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager. While the vulnerability is in Oracle Applications Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Privilege escalation and full takeover of Oracle Applications Manager (component: Internal Operations) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged remote attacker over HTTP to fully compromise the management product and, because of the scope change, significantly impact additional integrated products. Oracle rates the issue CVSS 9.9 with confidentiality, integrity, and availability impacts; no public exploit identified at time of analysis. Listed in the ENISA EUVD as EUVD-2026-37249 and addressed in Oracle's June 2026 Critical Patch Update.

Technical ContextAI

Oracle Applications Manager (OAM) is the web-based administration console bundled with the Oracle E-Business Suite 12.2 platform, used to monitor and operate the underlying Oracle Fusion Middleware, concurrent managers, workflow services, and database tier. The affected component is 'Internal Operations,' which exposes privileged management functions of the EBS technology stack over HTTP. CPE coverage (cpe:2.3:a:oracle_corporation:oracle_applications_manager:*) and the EUVD range identify all 12.2.x point releases from 12.2.3 up to and including 12.2.15. No CWE has been assigned by Oracle, but the CVSS profile (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) is characteristic of an authenticated authorization or input-handling flaw in an administration servlet that escapes its security boundary and is able to act on other tightly coupled EBS components.

RemediationAI

Patch available per vendor advisory: apply the fixes delivered in the Oracle Critical Patch Update of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html) for every EBS 12.2 instance between 12.2.3 and 12.2.15, following Oracle's CPU patching guidance and prerequisite bundle requirements. Until the CPU patch can be staged and tested, restrict network reachability of the Oracle Applications Manager URLs (typically /OA_HTML/oam/ and the Internal Operations endpoints) to a small administrative network or jump-host subnet via reverse-proxy ACLs or WebLogic plug-in rules, and tighten responsibilities so non-administrator EBS accounts cannot reach OAM functions (accepting that this can disrupt legitimate functional users who relied on OAM dashboards). Audit recent authentication and Internal Operations activity for unexpected low-privileged users invoking management actions, and rotate any credentials that may have been exposed through OAM-managed configuration.