CVE-2026-46934 affects Oracle Complex Maintenance, Repair and Overhaul within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is a difficult to exploit vulnerability that allows a low privileged attacker with network access via HTTP to compromise the product, potentially resulting in full takeover. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impacts on confidentiality, integrity, and availability. The vulnerability is identified with CWEs related to improper access control and authorization. Oracle has included this vulnerability in its June 2026 Critical Security Patch Update advisory, which contains 245 security patches across multiple products. The advisory urges customers to apply patches promptly but does not explicitly confirm a dedicated patch for this specific product version in the provided content. Workarounds include blocking network protocols required for exploitation and removing unnecessary privileges, though these may impact application functionality.

Successful exploitation of this vulnerability can lead to complete compromise (takeover) of the Oracle Complex Maintenance, Repair and Overhaul product, affecting confidentiality, integrity, and availability of the system. The attacker requires only low privileges and network access via HTTP but faces high attack complexity. There are no known exploits in the wild at this time.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this and other vulnerabilities. Until patches are applied, risk may be reduced by blocking network protocols required for the attack and by removing unnecessary privileges from users who do not require them. These mitigations may affect application functionality. Patch status for this specific vulnerability is not explicitly confirmed in the advisory; customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.