What is the CVSS score of EUVD-2026-46466?

EUVD-2026-46466 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle E-Business Suite are affected by EUVD-2026-46466?

Oracle Human Resources (E-Business Suite) versions 12.2.3-12.2.15 contains a critical vulnerability in the Data Removal Tool (CVSS 7.2) that threatens complete compromise of HR data and operations.

How to fix or mitigate EUVD-2026-46466?

Within 24 hours: Immediately inventory all Oracle E-Business Suite HR module installations, identify systems running affected versions 12.2.3-12.2.15, and implement firewall rules to restrict network access to the Data Removal Tool component. Within 7 days: Deploy network segmentation to isolate the HR module, enforce multi-factor authentication for all high-privilege administrative accounts, and evaluate operational feasibility of disabling the Data Removal Tool entirely. Within 30 days: Establish continuous monitoring of Oracle security advisories for vendor patch release; when a vendor-released patch becomes available, develop, test, and execute an upgrade to a patched Oracle EBS version; audit all high-privilege HR access logs for indicators of potential exploitation.

Oracle E-Business Suite EUVD-2026-46466

| CVE-2026-46954 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-6c8c-v8h5-fwx9

Authentication Bypass Oracle Oracle Human Resources Oracle Corporation

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Remote HTTP reachability (AV:N) with low complexity, but a high-privilege HRMS account is required (PR:H), yielding full C/I/A takeover with unchanged scope.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:11 vuln.today

CVE Published

Jul 21, 2026 - 21:32 cve.org

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Data Removal Tool). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Human Resources. Successful attacks of this vulnerability can result in takeover of Oracle Human Resources. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Human Resources (part of Oracle E-Business Suite) is possible via the Data Removal Tool component, where a high-privileged attacker with HTTP network access can take over the module across supported releases 12.2.3 through 12.2.15. The flaw carries a CVSS 3.1 base score of 7.2 with high confidentiality, integrity, and availability impact, and Oracle classifies it as easily exploitable. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The affected technology is Oracle Human Resources (Oracle HRMS), a core module of the Oracle E-Business Suite ERP platform, specifically its Data Removal Tool - functionality typically used to purge or anonymize personnel and HR data. Exploitation occurs over HTTP against the EBS application tier (Oracle Application Server / WebLogic front end). No CWE was assigned in the input (CWE: N/A), so the precise weakness class is not published; the Oracle tag 'Information Disclosure' plus the full C:H/I:H/A:H impact suggests the tool can be abused beyond intended data-removal boundaries to read, alter, and destroy HR data. The single CPE provided, cpe:2.3:a:oracle_corporation:oracle_human_resources:*:*:*:*:*:*:*:*, identifies the product but not exact version boundaries, which come from the description (12.2.3-12.2.15).

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); the input does not specify an exact patched build number, so treat this as 'Patch available per vendor advisory' and map your 12.2.x level to the corresponding CPU patch for EBS. As compensating controls until patching, restrict who holds high-privilege HR/EBS responsibilities and tightly scope access to the Data Removal Tool function, since exploitation requires PR:H - audit and reduce privileged HRMS accounts, enforce MFA on those accounts, and monitor for unexpected data-removal or purge operations. Additionally, limit network exposure of the EBS application tier so only trusted internal networks can reach it over HTTP, accepting the trade-off that this does not stop a malicious or compromised privileged insider and is only a containment measure, not a substitute for the CPU patch.