CVE-2026-46930: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle In-Memory Cost Management for Discrete Industries. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle In-Memory Cost Management for Discrete Industries accessible data as well as unauthorized access to critical data or complete access to all Oracle In-Memory Cost Management
CVE-2026-46930 is a critical vulnerability in Oracle In-Memory Cost Management for Discrete Industries (part of Oracle E-Business Suite) versions 12.2.12 through 12.2.15. It allows an unauthenticated attacker with network access via HTTPS to gain unauthorized creation, deletion, or modification access to critical data. The vulnerability has a CVSS 3.1 base score of 9.1, indicating high confidentiality and integrity impact without requiring user interaction or privileges. Oracle has published a Critical Security Patch Update advisory recommending prompt application of security patches to mitigate this risk.
AI Analysis
Technical Summary
This vulnerability affects Oracle In-Memory Cost Management for Discrete Industries within Oracle E-Business Suite versions 12.2.12 to 12.2.15. It allows an unauthenticated remote attacker to compromise the product via HTTPS, resulting in unauthorized creation, deletion, or modification of critical data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact. Oracle’s June 2026 Critical Security Patch Update advisory includes this vulnerability among 245 fixes and strongly recommends applying patches promptly. No explicit patch version or temporary workaround is detailed in the advisory excerpt, but Oracle emphasizes the importance of applying the CSPU without delay to mitigate exploitation risk.
Potential Impact
Successful exploitation allows an unauthenticated attacker with network access via HTTPS to gain unauthorized ability to create, delete, or modify critical data within Oracle In-Memory Cost Management for Discrete Industries. This results in a complete compromise of confidentiality and integrity of all accessible data in the affected product. Availability impact is not indicated. The vulnerability poses a critical risk to organizations using affected versions due to the potential for full data compromise without any authentication or user interaction.
Mitigation Recommendations
Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this vulnerability. The vendor advisory does not specify any temporary fixes or workarounds that fully mitigate the risk. Until patches are applied, reducing attack surface by blocking unnecessary network protocols or removing unneeded privileges may reduce risk but could impact application functionality. Patch status is not explicitly stated for this specific CVE in the advisory, so customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.
CVE-2026-46930: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle In-Memory Cost Management for Discrete Industries. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle In-Memory Cost Management for Discrete Industries accessible data as well as unauthorized access to critical data or complete access to all Oracle In-Memory Cost Management
Description
CVE-2026-46930 is a critical vulnerability in Oracle In-Memory Cost Management for Discrete Industries (part of Oracle E-Business Suite) versions 12.2.12 through 12.2.15. It allows an unauthenticated attacker with network access via HTTPS to gain unauthorized creation, deletion, or modification access to critical data. The vulnerability has a CVSS 3.1 base score of 9.1, indicating high confidentiality and integrity impact without requiring user interaction or privileges. Oracle has published a Critical Security Patch Update advisory recommending prompt application of security patches to mitigate this risk.
CVSS v3.1
Score 9.1critical
Affected software
pkg:maven/com.oracle/in-memory-cost-management-discrete-industriesRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects Oracle In-Memory Cost Management for Discrete Industries within Oracle E-Business Suite versions 12.2.12 to 12.2.15. It allows an unauthenticated remote attacker to compromise the product via HTTPS, resulting in unauthorized creation, deletion, or modification of critical data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact. Oracle’s June 2026 Critical Security Patch Update advisory includes this vulnerability among 245 fixes and strongly recommends applying patches promptly. No explicit patch version or temporary workaround is detailed in the advisory excerpt, but Oracle emphasizes the importance of applying the CSPU without delay to mitigate exploitation risk.
Potential Impact
Successful exploitation allows an unauthenticated attacker with network access via HTTPS to gain unauthorized ability to create, delete, or modify critical data within Oracle In-Memory Cost Management for Discrete Industries. This results in a complete compromise of confidentiality and integrity of all accessible data in the affected product. Availability impact is not indicated. The vulnerability poses a critical risk to organizations using affected versions due to the potential for full data compromise without any authentication or user interaction.
Mitigation Recommendations
Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this vulnerability. The vendor advisory does not specify any temporary fixes or workarounds that fully mitigate the risk. Until patches are applied, reducing attack surface by blocking unnecessary network protocols or removing unneeded privileges may reduce risk but could impact application functionality. Patch status is not explicitly stated for this specific CVE in the advisory, so customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-05-18T15:55:10.312Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/cspujun2026.html","vendor":"Oracle"}]
Threat ID: 6a31b62a0b89be6888266010
Added to database: 06/16/2026, 20:46:34 UTC
Last enriched: 06/24/2026, 16:42:00 UTC
Last updated: 07/31/2026, 22:21:39 UTC
Views: 106
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.