CVE-2026-46819 affects Oracle Internet Procurement Connector component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. The vulnerability permits an unauthenticated attacker with network access over HTTP to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all accessible data within the Oracle Internet Procurement Connector. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects that the attack can be performed remotely without privileges or user interaction, causing high confidentiality and integrity impacts. Oracle has addressed this vulnerability in its May 2026 Critical Security Patch Update, which includes 35 new security patches across multiple product families. Oracle strongly recommends applying these patches immediately and maintaining supported versions to ensure security. Temporary mitigations such as network protocol blocking or privilege removal may reduce risk but do not fix the underlying issue.

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to gain unauthorized creation, deletion, or modification access to critical data or full access to all data accessible by Oracle Internet Procurement Connector. This compromises confidentiality and integrity of the affected system's data. There is no impact on availability reported. The vulnerability is rated critical with a CVSS score of 9.1, reflecting its severity and ease of exploitation without requiring privileges or user interaction.

Oracle has released a Critical Security Patch Update in May 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the Critical Security Patch Update promptly to remediate this issue. Until patches are applied, risk may be temporarily reduced by blocking network protocols required for exploitation or removing unnecessary privileges from users, but these are not long-term solutions and may disrupt application functionality. Oracle recommends testing any mitigations in non-production environments. Maintaining supported product versions ensures eligibility for security updates.