Oracle HR Intelligence CVE-2026-46970

Attacker must possess high-privileged credentials on Oracle E-Business Suite (PR:H) - typically an HR Intelligence administrator or equivalent responsibility - and must be able to reach the EBS HTTP front end of an installation running Oracle E-Business Suite 12.2.3 through 12.2.15 with the HR Intelligence module deployed and the Internal Operations component accessible. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the PR:H prerequisite and the niche deployment of HR Intelligence (not every EBS customer licenses it) materially limit the exploitable population; installations that restrict the EBS web tier to internal management networks further reduce exposure.

The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H yields 7.2 (High), driven by full CIA impact tempered by the PR:H requirement, meaning the attacker must already hold high privileges in the EBS environment before exploitation. No EPSS score, KEV listing, SSVC decision, or public POC was provided, so the realistic exploitation likelihood appears low compared to unauthenticated EBS flaws in the same CPU. The most plausible threat model is privilege escalation or lateral abuse by an insider/compromised admin rather than mass exploitation; however, because Oracle does not publish CWE or technical details, defenders cannot independently validate the weakness class - patch on the standard Oracle CPU cadence and treat any HR Intelligence administrator account as a high-value target.

An attacker who already holds (or has compromised) an EBS account with high HR Intelligence privileges connects to the EBS HTTP endpoint and issues a crafted request against the Internal Operations component, abusing the unpatched flaw to take over the HR Intelligence module. The result is unauthorized read/write of HR analytics data and disruption of the service. No public proof-of-concept is identified at time of analysis.