What is the CVSS score of CVE-2026-46970?

CVE-2026-46970 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle HR Intelligence are affected by CVE-2026-46970?

Oracle E-Business Suite versions 12.2.3-12.2.15 contain a critical vulnerability in the HR Intelligence component that enables full system compromise by authenticated high-privileged users, risking…

How to fix or mitigate CVE-2026-46970?

Within 24 hours: Inventory all Oracle E-Business Suite instances in versions 12.2.3-12.2.15 and immediately restrict network access to the HR Intelligence component to defined administrative users only. Within 7 days: Deploy enhanced logging and real-time alerting on all privileged access to HR Intelligence; conduct access review of high-privilege accounts with terminations or role changes. Within 30 days: Begin testing upgrade path to version 12.2.16 or later once vendor releases patched release; evaluate compensating controls for systems that cannot be immediately patched; document HR Intelligence backup and recovery procedures for incident response preparation.

Oracle HR Intelligence CVE-2026-46970

EUVD-2026-37280 HIGH

Improper Privilege Management (CWE-269)

2026-06-16 oracle

Privilege Escalation Oracle Oracle Hr Intelligence Oracle Corporation

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable EBS HTTP endpoint (AV:N, AC:L), requires pre-existing high-privileged HR Intelligence account (PR:H), no user interaction, full takeover of the module gives C:H/I:H/A:H within the same scope.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:47 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle HR Intelligence. Successful attacks of this vulnerability can result in takeover of Oracle HR Intelligence. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle HR Intelligence (component: Internal Operations) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible by an authenticated high-privileged attacker over HTTP. Successful exploitation results in takeover of the HR Intelligence application with confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

Oracle HR Intelligence is an analytics/reporting module within the Oracle E-Business Suite 12.2 family that sits on top of the Oracle Applications stack (Fusion Middleware / Forms / OA Framework over an Oracle Database back end). The Internal Operations component handles administrative and back-office HR analytics workflows that are typically reachable via the EBS HTTP front end. No CWE was assigned by NVD or Oracle, so the underlying weakness class (e.g., access control, injection, or insecure deserialization) is not disclosed; only the impact and required privilege level are published, consistent with Oracle's standard Critical Patch Update advisory practice.

RemediationAI

Patch available per vendor advisory: apply the fixes shipped in the Oracle Critical Patch Update of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html) for all Oracle E-Business Suite 12.2.x deployments running HR Intelligence. Oracle's CPU bundles versioned EBS patches per release line; consult the advisory matrix for the exact patch number applicable to your 12.2.3-12.2.15 installation and apply via adop/AutoPatch with a maintenance window. As compensating controls until patching, restrict network reachability of the EBS HTTP tier to trusted management subnets only, tighten responsibility/role assignments so that very few users hold HR Intelligence administrative privileges, enable EBS audit (FND audit and DB-level auditing on relevant tables) to detect anomalous high-privilege actions, and rotate credentials of accounts with HR Intelligence admin responsibilities; side effects include possible disruption to legitimate report authors and added DBA workload from audit volume.