What is the CVSS score of CVE-2026-46956?

CVE-2026-46956 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Property Manager are affected by CVE-2026-46956?

Oracle Property Manager (Oracle E-Business Suite versions 12.2.3-12.2.15) contains a control takeover vulnerability enabling full system compromise for attackers who already possess high-privileged…

How to fix or mitigate CVE-2026-46956?

Within 24 hours: Inventory all Oracle EBS 12.2.3-12.2.15 instances and audit all users with high-privileged Property Manager roles (review access grants, role assignments, and recent administrative activity). Within 7 days: Implement least-privilege access controls to restrict Property Manager administrative roles to essential personnel, enable detailed audit logging for all Property Manager operations, and contact Oracle Support to obtain patch timeline and interim guidance. Within 30 days: Evaluate upgrade path to Oracle EBS 12.2.16 or later (if available), document all compensating controls in place, and establish monthly privilege-access reviews.

Oracle Property Manager CVE-2026-46956

EUVD-2026-37267 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Property Manager Oracle Corporation

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

HTTP-reachable (AV:N), Oracle labels easily exploitable (AC:L), requires high EBS privileges (PR:H), no user interaction, and full takeover of Property Manager yields C:H/I:H/A:H within an unchanged scope.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:53 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Property Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Property Manager. Successful attacks of this vulnerability can result in takeover of Oracle Property Manager. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Takeover of Oracle Property Manager (component: Internal Operations) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is achievable by a high-privileged attacker with HTTP network access, with no public exploit identified at time of analysis. Oracle rates the issue easily exploitable with full confidentiality, integrity, and availability impact, but the PR:H requirement narrows the practical attacker pool to those already holding elevated EBS application privileges. The flaw is disclosed in the Oracle Critical Patch Update of June 2026 and tagged as Information Disclosure / Oracle Property Manager.

Technical ContextAI

Oracle Property Manager is a real-estate/lease management module within the Oracle E-Business Suite (EBS) 12.2 platform, served over HTTP through the EBS application tier (Oracle HTTP Server / Forms / OA Framework). The affected 'Internal Operations' component handles back-end administrative workflows within the module. Per the CPE (cpe:2.3:a:oracle_corporation:oracle_property_manager:*) the vulnerable code ships as part of every EBS 12.2.3-12.2.15 release. Oracle did not assign a CWE; based on the 'takeover' wording and PR:H/AV:N profile, the root cause is most consistent with an authenticated server-side flaw (e.g., authorization bypass, unsafe deserialization, or injection) reachable through an HTTP-exposed Internal Operations endpoint, but the specific weakness class is not disclosed in the advisory.

RemediationAI

Apply the fixes shipped in the Oracle Critical Patch Update of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html), which delivers the Property Manager patch for EBS 12.2.3-12.2.15 via the standard EBS 12.2 patch bundle; consult the CPU Patch Availability Document for the exact patch numbers per platform and apply through adop/online-patching with standard pre-production validation. Until patching, compensating controls include restricting HTTP access to the Property Manager Internal Operations URLs at the Oracle HTTP Server / reverse proxy / WAF layer to known administrative source IPs, tightening the EBS responsibility/role assignments so that very few users hold the privileged role required for exploitation (PR:H), and increasing audit-log review on Property Manager admin actions; trade-offs are that URL-level blocking can break legitimate admin workflows and over-restricting responsibilities may impact business operations. Do not rely on TLS or generic WAF rules alone, as the flaw is reachable post-authentication.