CVE-2026-46935 is a vulnerability in Oracle Complex Maintenance, Repair and Overhaul (part of Oracle E-Business Suite) affecting versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access over HTTP to compromise the product, potentially resulting in full takeover. The vulnerability has a CVSS 3.1 score of 7.5 with high impacts on confidentiality, integrity, and availability, and requires high attack complexity. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability among 245 other patches. Oracle strongly recommends applying these patches without delay to prevent exploitation. No known exploits in the wild have been reported as of the advisory date.

Successful exploitation can lead to complete compromise of Oracle Complex Maintenance, Repair and Overhaul, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product, potentially leading to unauthorized access and control over sensitive maintenance and repair operations within Oracle E-Business Suite environments.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers should apply the provided security patches as soon as possible to remediate the issue. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges from users. Oracle strongly recommends staying on actively supported versions and promptly applying security updates. Patch status is not explicitly confirmed for this specific vulnerability in the advisory, so customers should consult the Oracle Critical Security Patch Update documentation for detailed patch availability and installation instructions.