CVE-2026-46939 is a vulnerability in the Oracle Configure to Order product of Oracle E-Business Suite (component: Supply to Order Workbench) affecting versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data or full access to all accessible data. The vulnerability has a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vendor advisory is part of Oracle's June 2026 Critical Security Patch Update, which addresses this and many other vulnerabilities. However, the advisory does not explicitly confirm patch availability or remediation status for this specific CVE. Oracle recommends applying the Critical Security Patch Update without delay to mitigate the risk. Workarounds include blocking network protocols required for exploitation and removing unnecessary privileges, though these may affect application functionality.

Successful exploitation of CVE-2026-46939 can lead to unauthorized creation, deletion, or modification of critical data within Oracle Configure to Order, or unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of the data but does not impact availability. The vulnerability requires network access via HTTP and low privileges, making it relatively easy to exploit in environments where the product is accessible over the network.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update promptly, which includes security patches addressing this vulnerability. Until patches are applied, risk can be mitigated by blocking network protocols required for exploitation and by removing unnecessary privileges or access to sensitive packages from users who do not need them. These mitigations may impact application functionality, so they should be tested carefully. Patch status for this specific vulnerability is not explicitly confirmed in the advisory; customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest remediation guidance.