Oracle Subledger Accounting CVE-2026-46959

Attacker must (1) have network reachability to the Oracle E-Business Suite HTTP tier (AV:N over HTTP), (2) hold valid low-privileged EBS application credentials (PR:L) - Oracle's wording 'low privileged attacker' rules out fully unauthenticated exploitation, and (3) overcome AC:H conditions, meaning success depends on factors outside the attacker's control such as specific timing, server state, or non-default configuration of the Internal Operations component within Oracle Subledger Accounting. Exploitation is limited to EBS 12.2.3-12.2.15 deployments running the Subledger Accounting product; environments that do not license or enable SLA, or that gate the HTTP tier behind VPN/SSO step-up, materially reduce reachability. No user interaction is required (UI:N) and scope is unchanged (S:U).

The CVSS 3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H yields a 7.5 score that captures full-CIA impact tempered by high attack complexity and a requirement for low-privileged authentication. The AC:H rating indicates exploitation depends on conditions outside the attacker's control (race, specific state, or configuration) and is not point-and-click, which materially lowers real-world risk versus a typical 7.5. The CVE is not listed in CISA KEV and there is no public exploit identified at time of analysis; EPSS data was not provided. Because EBS deployments typically restrict the HTTP tier to internal users and any authenticated EBS user (PR:L) could be the abuse vector, the realistic threat profile is an insider or post-foothold attacker pivoting from a compromised low-privilege EBS account rather than mass internet exploitation. CWE is N/A, which limits deeper attack-pattern reasoning - defenders should treat Oracle's CPU advisory as the authoritative source.

An attacker who has obtained or been issued a low-privileged EBS application account (e.g., via phishing of a finance user or reuse of leaked SSO credentials) authenticates to the EBS HTTP tier and issues a crafted request against the Subledger Accounting Internal Operations endpoint, exploiting the high-complexity flaw to escalate within the module and read, modify, or disrupt subledger accounting data - effectively a full takeover of the SLA module that could be used to falsify journal entries or sabotage period close. No public exploit code is identified at time of analysis.