CVE-2026-46915 is a vulnerability in Oracle Complex Maintenance, Repair and Overhaul (part of Oracle E-Business Suite) affecting versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access over HTTP to compromise the product, potentially leading to full takeover. The vulnerability has a CVSS 3.1 score of 8.5 with high confidentiality, integrity, and availability impacts, and a scope change indicating possible impact on additional Oracle products. Exploitation requires high attack complexity but no user interaction. Oracle’s June 2026 Critical Security Patch Update advisory references this vulnerability and strongly recommends applying patches promptly. No explicit patch version is provided in the advisory content. Mitigation includes applying the Critical Security Patch Update and blocking relevant network protocols until patched. Removing unnecessary privileges may also help reduce risk but may affect application functionality.

Successful exploitation of this vulnerability can result in complete takeover of Oracle Complex Maintenance, Repair and Overhaul, impacting confidentiality, integrity, and availability of the product. The vulnerability also has a scope change, meaning attacks may significantly affect additional Oracle products beyond the initially vulnerable component. The CVSS vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, and full impact on confidentiality, integrity, and availability.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update promptly to address this vulnerability. Until patches are applied, risk can be reduced by blocking network protocols required by the attack and removing unnecessary privileges from users who do not need them. These mitigations may impact application functionality. No official patch version is specified in the advisory; customers should consult the Oracle Critical Security Patch Update documentation for patch availability and installation instructions.