What is the CVSS score of CVE-2026-46969?

CVE-2026-46969 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-46969?

A vulnerability in Oracle E-Business Suite Financials module (versions 12.2.3-12.2.15) serving EMEA operations exposes the organization to insider threats: high-privilege users with system access…

How to fix or mitigate CVE-2026-46969?

Within 24 hours: Audit all high-privilege user accounts with access to Oracle E-Business Suite 12.2.3-12.2.15 and review administrative activity logs for anomalies. Within 7 days: Implement network segmentation restricting HTTP access to Oracle EBS to essential personnel only; enforce multi-factor authentication on all high-privilege accounts; enable comprehensive transaction and administrative audit logging. Within 30 days: Establish timeline with Oracle for upgrade to version 12.2.16 or later pending security patch; deploy continuous monitoring for high-privilege user behavior anomalies.

Oracle E-Business Suite CVE-2026-46969

EUVD-2026-37279 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Financials For Emea Oracle Corporation

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

HTTP-reachable EBS endpoint (AV:N/AC:L), requires high-privileged Financials for EMEA account (PR:H), no user interaction, results in full module takeover (C:H/I:H/A:H), no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:47 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Financials for EMEA product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Financials for EMEA. Successful attacks of this vulnerability can result in takeover of Oracle Financials for EMEA. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Privileged takeover of Oracle Financials for EMEA (component: Internal Operations) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows an authenticated high-privileged attacker with HTTP network access to fully compromise confidentiality, integrity, and availability of the module. The CVSS 3.1 base score is 7.2 with vector AV:N/AC:L/PR:H/UI:N, and there is no public exploit identified at time of analysis.

Technical ContextAI

Oracle E-Business Suite (EBS) is Oracle's flagship on-premises ERP platform; Oracle Financials for EMEA is the regional financial-management module that handles European/Middle East/Africa-specific statutory reporting, tax, and accounting flows. The affected 'Internal Operations' sub-component is exposed over the EBS application tier via HTTP, typically through the Oracle HTTP Server/WebLogic front-end that fronts OA Framework forms and self-service pages. No CWE was assigned by Oracle (CPU advisories routinely omit CWE detail), but the combined high-confidentiality, high-integrity, high-availability impact with low attack complexity is consistent with an authenticated business-logic or injection flaw in an EBS internal operations endpoint rather than a memory-corruption issue.

RemediationAI

Apply the fixes delivered in the Oracle June 2026 Critical Patch Update as documented at https://www.oracle.com/security-alerts/cspujun2026.html - Patch available per vendor advisory; a specific patched build number was not provided in the supplied intelligence, so consult the CPU matrix for the exact patch ID matching your 12.2.x release. Until the CPU is rolled out, reduce risk by tightly auditing and minimising assignment of high-privilege Oracle Financials for EMEA responsibilities, restricting network reachability of the EBS application tier to trusted management networks and VPN-only access (trade-off: may break legitimate internal user workflows that rely on broad intranet access), and enabling EBS application-tier and database auditing on Financials for EMEA Internal Operations transactions to detect anomalous high-privilege activity. Avoid exposing the EBS web tier directly to the internet; if external access is required, front it with a reverse proxy that enforces strong authentication and IP allow-listing.