What is the CVSS score of CVE-2026-46952?

CVE-2026-46952 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-46952?

Oracle E-Business Suite Quality module (versions 12.2.3-12.2.15) contains an account takeover vulnerability allowing low-privileged attackers to fully compromise the Quality component.

How to fix or mitigate CVE-2026-46952?

Within 24 hours: Identify all affected EBS Quality module instances (versions 12.2.3-12.2.15) and document user accounts with Quality access. Within 7 days: Deploy Web Application Firewall rules targeting the Internal Operations component, enforce multi-factor authentication for Quality module users, implement IP whitelisting where operationally feasible, and enable detailed access logging. Within 30 days: Contact Oracle to determine patch availability; plan upgrade to patched versions if available, or establish compensating controls as permanent security measures if no patches are released.

Oracle E-Business Suite CVE-2026-46952

EUVD-2026-37264 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Quality Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Reachable over HTTP with any low-privilege EBS account and no user interaction; Oracle states full takeover of the Quality module, giving high C/I/A within an unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:55 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Quality. Successful attacks of this vulnerability can result in takeover of Oracle Quality. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Account takeover in the Oracle Quality module of Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the Quality component, impacting confidentiality, integrity, and availability (CVSS 3.1 8.8). The flaw resides in the Internal Operations component and is rated easily exploitable by Oracle's own advisory, though no public exploit identified at time of analysis and the issue is not yet listed in CISA KEV.

Technical ContextAI

Oracle Quality is a manufacturing-quality management module within Oracle E-Business Suite (EBS) 12.2, the long-running ERP platform built on Oracle Application Server / WebLogic and the Oracle Database. The CPE 'cpe:2.3:a:oracle_corporation:oracle_quality' confirms the Quality application itself is the vulnerable surface, exposed over HTTP through the EBS web tier (typically the Oracle HTTP Server forms/OAF stack). No CWE is published by Oracle, which is consistent with their standard practice of withholding root-cause detail; the 'Internal Operations' component label combined with the network/HTTP attack vector points to a server-side flaw reachable through an authenticated EBS session rather than a client-side or forms-applet weakness.

RemediationAI

Apply the fixes shipped in Oracle's June 2026 Critical Patch Update (Patch available per vendor advisory at https://www.oracle.com/security-alerts/cspujun2026.html); Oracle does not publish individual fix-version numbers per CVE, so administrators must apply the CPU bundle that covers EBS 12.2.3-12.2.15. Until the CPU is applied, restrict network reach to the EBS web tier by placing it behind a VPN or reverse proxy with IP allow-listing, audit and disable unused low-privilege EBS responsibilities that grant access to the Quality module, and increase monitoring of Oracle HTTP Server access logs for anomalous requests to /OA_HTML/ Quality endpoints; the trade-off is that VPN/allow-list controls do not stop authenticated insider abuse, which is the very threat model this CVE describes.