What is the CVSS score of CVE-2026-46944?

CVE-2026-46944 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle iSupport are affected by CVE-2026-46944?

A critical vulnerability in Oracle E-Business Suite iSupport (versions 12.2.3-12.2.15) enables authenticated high-privileged users to achieve complete system takeover with scope impact to dependent…

How to fix or mitigate CVE-2026-46944?

Within 24 hours: Inventory Oracle E-Business Suite versions 12.2.3-12.2.15 across all environments and identify high-privileged iSupport users; escalate to Oracle Support for interim guidance. Within 7 days: Restrict iSupport access to the minimum necessary high-privileged administrators; implement comprehensive audit logging and real-time alerting for iSupport transactions. Within 30 days: Monitor Oracle's June 2026 CPU advisories for patch release; conduct a review of privileged account controls for all affected systems.

Oracle iSupport CVE-2026-46944

EUVD-2026-37257 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Isupport Oracle Corporation

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.1 CRITICAL

HTTP-reachable EBS module so AV:N/AC:L/UI:N; requires high-privileged EBS account so PR:H; full iSupport takeover with impact on other modules gives S:C and C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:59 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle iSupport. While the vulnerability is in Oracle iSupport, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle iSupport. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle iSupport (component: Internal Operations) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is achievable by an authenticated high-privileged attacker over HTTP, with a scope change that lets the attack significantly impact additional products beyond iSupport itself. The flaw carries a CVSS 3.1 base score of 9.1 with confidentiality, integrity, and availability all rated High, and no public exploit identified at time of analysis. The vendor (Oracle) is the sole reporting source via the June 2026 Critical Patch Update advisory.

Technical ContextAI

Oracle iSupport is a self-service customer support module within the Oracle E-Business Suite (EBS) family, deployed on top of the Oracle Applications technology stack (Oracle HTTP Server, WebLogic/Forms, and the underlying Oracle Database). The vulnerable component is identified as 'Internal Operations,' which typically covers internal administrative servlets/APIs exposed under the iSupport application context. The CPE 'cpe:2.3:a:oracle_corporation:oracle_isupport' confirms the iSupport application as the affected product, and the scope-change flag (S:C) in the CVSS vector indicates the vulnerable code can act on resources owned by other EBS modules (shared APPS schema, single sign-on, or cross-module session context). No CWE was assigned, but the combination of high-privileged HTTP-driven 'takeover' plus scope change is consistent with insufficient authorization checks or unsafe operation exposure in an internal EBS servlet.

RemediationAI

Patch available per vendor advisory: apply the fixes bundled in the Oracle Critical Patch Update of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html) to all Oracle E-Business Suite 12.2.3-12.2.15 environments running iSupport; specific patch numbers are listed inside the CPU patch availability matrix and should be selected per EBS release level. Until the CPU is applied, restrict network reachability of the iSupport application URLs to trusted internal networks or VPN only (trade-off: breaks legitimate external customer self-service), tighten responsibility/role assignments so that high-privilege EBS responsibilities are limited to a small, audited set of accounts (trade-off: administrative friction), and enable WebLogic/OHS access logging plus FND audit on iSupport Internal Operations endpoints to detect privileged misuse. Because the issue exhibits CVSS scope change, also review trust relationships and shared sessions between iSupport and adjacent EBS modules before relying on network controls alone.