CVE-2026-46933 is an easily exploitable vulnerability in Oracle Applications Manager (component: Internal Operations) affecting versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise Oracle Applications Manager, potentially resulting in full takeover. The vulnerability also has scope change implications, meaning it may affect additional Oracle products beyond Applications Manager. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle’s June 2026 Critical Security Patch Update advisory addresses this vulnerability among others and strongly recommends applying patches promptly. No specific fixed version is detailed in the advisory content provided.

Successful exploitation allows an attacker with low privileges and network access via HTTP to take over Oracle Applications Manager, compromising confidentiality, integrity, and availability of the system. The vulnerability’s scope change means that other Oracle products integrated or dependent on Applications Manager may also be significantly impacted. This can lead to unauthorized access, data breaches, and disruption of critical business operations managed through Oracle Applications Manager.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update immediately to address this vulnerability and others. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges or access to sensitive packages from users who do not require them. However, these mitigations may disrupt application functionality. Customers should follow Oracle’s official patch documentation and advisories for detailed installation instructions and further guidance.