What is the CVSS score of CVE-2026-46942?

CVE-2026-46942 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Process Manufacturing are affected by CVE-2026-46942?

Oracle Process Manufacturing versions 12.2.3-12.2.15 in E-Business Suite contain a critical vulnerability (CVSS 8.8) allowing remote low-privileged attackers to achieve complete system takeover,…

How to fix or mitigate CVE-2026-46942?

Within 24 hours: Identify and inventory all Oracle E-Business Suite instances running Process Manufacturing versions 12.2.3 through 12.2.15. Within 7 days: Implement network-level access controls restricting HTTP access to the Internal Operations component; deploy web application firewall rules to monitor and block exploitation attempts. Within 30 days: Monitor Oracle Security Advisories for patch release and establish upgrade timeline; escalate to change management for priority scheduling once patch becomes available.

Oracle Process Manufacturing CVE-2026-46942

EUVD-2026-37256 HIGH

Improper Privilege Management (CWE-269)

2026-06-16 oracle

Oracle Oracle Process Manufacturing Process Planning Privilege Escalation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

HTTP-reachable EBS module exploitable by any low-privileged user without interaction, yielding full module takeover, so AV:N/AC:L/PR:L/UI:N with C:H/I:H/A:H and unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:00 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Process Manufacturing Process Planning product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Process Planning. Successful attacks of this vulnerability can result in takeover of Oracle Process Manufacturing Process Planning. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Takeover of Oracle Process Manufacturing Process Planning (versions 12.2.3 through 12.2.15) is achievable by a low-privileged remote attacker over HTTP through the Internal Operations component of Oracle E-Business Suite. The flaw carries a CVSS 3.1 base score of 8.8 with full confidentiality, integrity, and availability impact, and Oracle has classified it as easily exploitable. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain low-privileged EBS credential

Delivery

Reach OPM Process Planning HTTP endpoint

Exploit

Send crafted Internal Operations request

Execution

Exploit authorization flaw

Persist

Take over Process Planning module

Impact

Tamper with manufacturing data and exfiltrate

Access

Obtain low-privileged EBS credential

Delivery

Reach OPM Process Planning HTTP endpoint

Exploit

Send crafted Internal Operations request

Execution

Exploit authorization flaw

Persist

Take over Process Planning module

Impact

Tamper with manufacturing data and exfiltrate

Vulnerability AssessmentAI

Exploitation	Requires network reachability to the Oracle E-Business Suite HTTP tier hosting the Oracle Process Manufacturing Process Planning module (Internal Operations component) on versions 12.2.3 through 12.2.15, plus a valid low-privileged EBS account (CVSS PR:L) - no specific OPM responsibility or administrative role is indicated as required, and no user interaction is needed (UI:N). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	All available signals point to a genuinely high-priority issue rather than a paper tiger: the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates network reach, no user interaction, only low-privilege authentication, and complete compromise of the module, which Oracle itself summarises as 'easily exploitable' and resulting in 'takeover'. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who has obtained any low-privileged EBS account, for example through a phished plant operator or a contractor login, sends a crafted HTTP request to the OPM Process Planning Internal Operations endpoint and gains full takeover of the module, enabling tampering with production plans and exfiltration of manufacturing data. Because the vector is AV:N/AC:L/UI:N, the request can be issued directly from any host that can reach the EBS web tier, with no social engineering or chained bug required. …
Remediation	Apply the patch available per vendor advisory in the Oracle Critical Security Patch Update of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html), which covers OPM Process Planning 12.2.3-12.2.15; Oracle does not publish per-CVE point versions, so apply the CPU bundle aligned to your EBS 12.2 baseline. … Detailed patch versions, workarounds, and compensating controls in full report.