What is the CVSS score of CVE-2026-46982?

CVE-2026-46982 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Retail Integration Bus are affected by CVE-2026-46982?

Oracle Retail Integration Bus 14.1.3.2 contains a critical vulnerability (CVSS 9.8) permitting complete remote compromise without authentication, directly threatening order processing, inventory…

How to fix or mitigate CVE-2026-46982?

Within 24 hours: inventory all systems running RIB 14.1.3.2 and immediately isolate critical instances from untrusted networks; engage Oracle Support regarding patch timeline. Within 7 days: implement network-level access controls restricting HTTP connectivity to RIB systems, deploy Web Application Firewall with anomaly detection, and enable comprehensive logging of all RIB transactions. Within 30 days: monitor for vendor-released patch availability and develop implementation roadmap; ensure all compensating controls are operational with 24/7 monitoring; conduct threat-hunting for exploitation indicators on RIB systems.

Oracle Retail Integration Bus CVE-2026-46982

EUVD-2026-46471 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-wpvm-2c56-5gwh

Authentication Bypass Oracle Oracle Retail Integration Bus Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated network HTTP access with low complexity and no user interaction yields full product takeover, justifying AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:12 vuln.today

CVE Published

Jul 21, 2026 - 21:32 cve.org

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Retail Integration Bus product of Oracle Retail Applications (component: RIB Kernal). The supported version that is affected is 14.1.3.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Integration Bus. Successful attacks of this vulnerability can result in takeover of Oracle Retail Integration Bus. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Retail Integration Bus 14.1.3.2 (RIB Kernel component) allows a remote, unauthenticated attacker to take over the product over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw is rated CVSS 9.8 with high confidentiality, integrity, and availability impact and is described by Oracle as 'easily exploitable.' No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Oracle Retail Integration Bus (RIB) is enterprise middleware that brokers asynchronous message-based integration between Oracle Retail applications (e.g., Merchandising, Store Inventory Management) using a JMS/HTTP transport layer; the affected 'RIB Kernel' is the core routing and message-processing engine. The affected component is exposed over HTTP, and the CVSS vector (AV:N/AC:L/PR:N/UI:N) plus Oracle's 'takeover' language indicate a network-reachable pre-authentication weakness in request handling. No CWE was assigned in the input, so the precise root-cause class (e.g., deserialization, injection, or authentication bypass) cannot be confirmed from the available data; Oracle CPUs commonly attribute such 'takeover' HTTP flaws in Java middleware to unsafe deserialization or authentication bypass, but this is unconfirmed here.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Patch available per vendor advisory (Oracle CPU July 2026), though an exact patched build number is not specified in the available data, so consult the CPU patch matrix for the RIB 14.1.3.2 fix and apply it. Because the input does not confirm a discrete fix version, verify the correct patch/bundle for your deployment before scheduling. As compensating controls until patched, restrict network access to the RIB HTTP/JMS listener endpoints to only trusted internal integration hosts via firewall or network segmentation (trade-off: may break legitimate integrations with distributed retail apps if allow-lists are incomplete), place the RIB interface behind a reverse proxy or WAF that filters unexpected HTTP requests, and remove any exposure of RIB to untrusted or internet-facing networks. Increase monitoring of the RIB application server logs for anomalous HTTP requests during the exposure window.