CVE-2026-46944 is a critical security vulnerability in Oracle iSupport versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite Internal Operations. The flaw allows a high privileged attacker with network access over HTTP to compromise Oracle iSupport, potentially resulting in full product takeover. The vulnerability has a CVSS 3.1 score of 9.1, indicating high impact on confidentiality, integrity, and availability, and includes scope change affecting additional Oracle products. Oracle's June 2026 Critical Security Patch Update addresses this vulnerability among 245 others. Oracle strongly recommends applying these patches immediately. Workarounds include blocking network protocols required for exploitation and removing unnecessary privileges, though these may disrupt normal operations.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle iSupport, including full takeover of the product. The vulnerability impacts confidentiality, integrity, and availability of the affected system. Additionally, due to scope change, attacks may significantly affect other Oracle products integrated or related to Oracle iSupport. This elevates the risk to a critical level, potentially affecting business operations relying on Oracle E-Business Suite components.

Oracle has released a Critical Security Patch Update in June 2026 that addresses CVE-2026-46944. Customers are strongly advised to apply this patch without delay to remediate the vulnerability. Until patches are applied, risk can be partially mitigated by blocking network protocols required for exploitation and by removing unnecessary privileges from users who do not require them. However, these workarounds may impact application functionality. Oracle recommends remaining on actively supported versions and promptly applying all security patches as the primary mitigation strategy.