What is the CVSS score of CVE-2026-46967?

CVE-2026-46967 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-46967?

Oracle Public Sector Financials versions 12.2.3 through 12.2.15 contain an authorization flaw enabling low-privileged authenticated users to gain complete control over the affected system, creating…

How to fix or mitigate CVE-2026-46967?

Within 24 hours: Identify and inventory all systems running Oracle Public Sector Financials versions 12.2.3-12.2.15; document current network exposure and user access patterns. Within 7 days: Implement network segmentation to restrict HTTP access to affected systems; deploy enhanced monitoring for privilege escalation attempts; enforce principle of least privilege across user accounts. Within 30 days: Establish direct communication with Oracle to confirm patch timeline for versions 12.2.16+; develop and test upgrade path; execute remediation once patch is released and validated.

Oracle E-Business Suite CVE-2026-46967

EUVD-2026-37278 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Public Sector Financials International Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

HTTP-reachable EBS module exploitable by any authenticated low-privileged user (PR:L) with no interaction or complexity, yielding full module takeover (C/I/A:H), scope unchanged within EBS.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:48 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component: Authorization). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Financials (International). Successful attacks of this vulnerability can result in takeover of Oracle Public Sector Financials (International). CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Authorization flaw in Oracle Public Sector Financials (International) versions 12.2.3 through 12.2.15 enables low-privileged authenticated attackers with HTTP network access to fully take over the affected component. Oracle's Critical Patch Update describes the issue as easily exploitable with high impact to confidentiality, integrity, and availability (CVSS 8.8). No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Oracle Public Sector Financials (International) is a localization module within Oracle E-Business Suite 12.2, an on-premises ERP platform used by government and public-sector organizations for financial management. The affected component is Authorization, indicating a broken access control class of weakness (CWE-285/CWE-862-style) in which the module fails to properly verify that an authenticated user is permitted to perform a given action over HTTP. While Oracle did not publish a specific CWE and the CPE string (cpe:2.3:a:oracle_corporation:oracle_public_sector_financials_(international):*) does not enumerate sub-versions, Oracle's advisory text scopes the defect to EBS 12.2.3 through 12.2.15, meaning every supported 12.2 release line is in scope.

RemediationAI

Apply the Oracle Critical Patch Update referenced in the June 2026 advisory at https://www.oracle.com/security-alerts/cspujun2026.html; Oracle's CPU bundles the fix for CVE-2026-46967 across the 12.2.3-12.2.15 supported branches and specific patch numbers must be retrieved from My Oracle Support for the deployed version (exact patched build identifier not independently confirmed beyond the CPU advisory). Until the CPU is applied, restrict network reachability of the EBS application tier to trusted internal networks via firewall or WAF rules, tighten the EBS responsibility/role assignments so that low-privileged accounts cannot reach Public Sector Financials (International) menus or URLs, and increase audit logging on the FND_LOGINS/FND_LOG_MESSAGES tables to detect anomalous use of the module - note these controls reduce but do not remove exposure, since any authenticated EBS user with HTTP reachability remains a viable attack origin.