What is the CVSS score of CVE-2026-46939?

CVE-2026-46939 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Configure to Order are affected by CVE-2026-46939?

Oracle E-Business Suite Configure to Order module (versions 12.2.3-12.2.15) is vulnerable to data manipulation by internal users holding low-privilege accounts, enabling unauthorized modification or…

How to fix or mitigate CVE-2026-46939?

Within 24 hours: Identify all systems running Oracle E-Business Suite versions 12.2.3 through 12.2.15 with Configure to Order/Supply to Order Workbench enabled; enumerate user accounts with access. Within 7 days: Implement comprehensive database audit logging (capture all INSERT, UPDATE, DELETE operations on Supply to Order tables); restrict module access to essential business roles only; enable change notifications for sensitive order fields. Within 30 days: Establish daily reconciliation procedures for order and inventory records to detect unauthorized changes; monitor Oracle advisories for patch availability; develop formal upgrade or remediation plan with executive sponsorship.

Oracle Configure to Order CVE-2026-46939

EUVD-2026-37254 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Configure To Order Oracle Corporation

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

HTTP-reachable EBS module exploitable by any authenticated low-privileged user (AV:N/AC:L/PR:L/UI:N); full read/write to CtO data gives C:H/I:H, no availability impact stated so A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:01 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Configure to Order product of Oracle E-Business Suite (component: Supply to Order Workbench). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Configure to Order. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Configure to Order accessible data as well as unauthorized access to critical data or complete access to all Oracle Configure to Order accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Authenticated data tampering and disclosure in Oracle Configure to Order (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with network access via HTTP to fully read, modify, create, or delete all data accessible to the Supply to Order Workbench component. Oracle rates the issue CVSS 8.1 and describes it as easily exploitable; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Technical ContextAI

Oracle Configure to Order is an order-management module within the Oracle E-Business Suite 12.2 application family, and the flaw lives in its Supply to Order Workbench component, which orchestrates configured-item supply across procurement and manufacturing. The CPE cpe:2.3:a:oracle_corporation:oracle_configure_to_order covers all 12.2.x releases between 12.2.3 and 12.2.15, indicating a long-standing defect in the HTTP-exposed application logic rather than the underlying database or middleware tier. No CWE is published, but the 'Authentication Bypass' tag combined with C:H/I:H and PR:L impact suggests an authorization-control failure in the Workbench's HTTP handlers that lets an authenticated EBS user reach data and operations outside their intended privilege scope.

RemediationAI

Apply the Oracle Critical Patch Update fixes referenced in the June 2026 Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspujun2026.html for each EBS 12.2.x release between 12.2.3 and 12.2.15; Oracle delivers these as patchset bundles tracked per EBS version, and exact patch numbers should be pulled from My Oracle Support based on the running 12.2.x level. Until the CPU is deployed, compensating controls include restricting network reachability of the Configure to Order and Supply to Order Workbench URLs to trusted internal networks via the EBS reverse proxy or WAF (trade-off: blocks legitimate remote planners and partner integrations), tightening EBS responsibility and menu assignments so that only a minimum set of users hold any Configure to Order responsibility (trade-off: may interrupt order processing workflows), and increasing audit logging on Supply to Order Workbench transactions to detect anomalous data modification. No vendor-released patch version was independently confirmed beyond the CPU advisory reference in the provided data.