CVE-2026-46928 affects Oracle Spares Management in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is an easily exploitable vulnerability that allows a low privileged attacker with network access via HTTPS to compromise the product, resulting in potential full takeover. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update advisory references this vulnerability among 245 patches but does not explicitly state a dedicated patch or remediation level for it. Oracle recommends applying the Critical Security Patch Update without delay and suggests possible temporary mitigations such as blocking attack-related network protocols or removing unnecessary privileges, though these may disrupt application functionality.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Spares Management, impacting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product, potentially leading to unauthorized access, data manipulation, and service disruption.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update promptly, which addresses this and other vulnerabilities. No explicit patch availability or remediation level is confirmed for this specific vulnerability beyond the general advisory. Until patches are applied, risk may be reduced by blocking network protocols required by an attack or removing unnecessary privileges from users, though these measures may affect application functionality. Customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for detailed patch availability and installation instructions.