Oracle E-Business Suite CVE-2026-46954

Exploitation requires an authenticated high-privileged attacker (CVSS PR:H) with network access to the Oracle E-Business Suite application tier over HTTP, targeting the Data Removal Tool component of Oracle Human Resources on versions 12.2.3-12.2.15. The limiting factors are significant: the attacker must already possess high application privileges (no anonymous or low-privilege path), no user interaction by a victim is needed (UI:N), and the scope is unchanged (S:U). There is no indication a non-default configuration is required - the Data Removal Tool is standard HRMS functionality - but the mandatory high-privilege level means realistic risk is concentrated in malicious insiders or attackers who have already escalated to a privileged EBS account.

The signals point to a genuine but privilege-gated risk. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) shows remote HTTP reachability and low complexity, but PR:H is the decisive limiter - the attacker must already hold high application privileges, which sharply narrows the realistic threat population to insiders or attackers who have already compromised a privileged EBS account. No EPSS score was supplied, and the CVE is not in CISA KEV, with no public exploit identified, so there is no evidence of active or imminent mass exploitation. The result is a high-severity-by-impact but access-constrained issue: total module takeover if the privilege precondition is met, but not a wormable internet-facing threat. Note a mild tension in the source data: the tag says 'Information Disclosure' while the impact metrics assert full C/I/A takeover - treat the impact as the authoritative signal but verify the exact abuse primitive against Oracle's advisory.

An attacker who has obtained or been granted a high-privilege Oracle HRMS account sends crafted HTTP requests to the Data Removal Tool component and leverages it to read, modify, and destroy Human Resources data, achieving full takeover of the module. Because access complexity is low (AC:L) the attack is reliable once the privilege precondition is met, but no public proof-of-concept exists at time of analysis.