CVE-2026-46934 is a vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product (part of Oracle E-Business Suite) affecting versions 12.2.3 through 12.2.15. The flaw allows a low privileged attacker with network access via HTTP to compromise the product, potentially resulting in full takeover. The vulnerability has a CVSS 3.1 score of 7.5, indicating high impact on confidentiality, integrity, and availability. Oracle has published this vulnerability in its June 2026 Critical Security Patch Update advisory, which includes 245 security patches across multiple Oracle products. The advisory emphasizes the importance of applying patches without delay and notes that Oracle continues to see exploitation attempts against vulnerabilities for which patches exist but have not been applied. No explicit patch availability or remediation level is stated for this specific CVE in the advisory, but the overall update strongly recommends applying the June 2026 Critical Security Patch Update.

Successful exploitation of this vulnerability can lead to complete takeover of the Oracle Complex Maintenance, Repair and Overhaul product, impacting confidentiality, integrity, and availability of the system. The attacker requires only low privileges and network access via HTTP, though the vulnerability is described as difficult to exploit. This could allow unauthorized access and control over the affected Oracle E-Business Suite component.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which addresses this vulnerability among others. Until patches are applied, risk can be partially mitigated by blocking network protocols required for exploitation and removing unnecessary privileges from users. However, these mitigations may disrupt application functionality. There is no explicit statement that a patch for this specific vulnerability is separately available outside the June 2026 update. Patch status is not yet confirmed explicitly for this CVE; customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest remediation guidance and patch availability.