CVE-2026-46944 is a critical vulnerability in the Oracle iSupport component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a high privileged attacker with network access via HTTP to compromise Oracle iSupport, resulting in a complete takeover of the product. The vulnerability affects confidentiality, integrity, and availability and has a CVSS 3.1 score of 9.1 with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The vulnerability may also impact additional Oracle products due to scope change. Oracle has included this vulnerability in its June 2026 Critical Security Patch Update advisory but has not explicitly confirmed a dedicated patch or fix for this vulnerability in the advisory content. Oracle strongly advises customers to apply the June 2026 Critical Security Patch Update to address this and other vulnerabilities. Mitigation options include blocking network protocols required for exploitation and removing unnecessary privileges from users, though these may disrupt application functionality.

Successful exploitation allows a high privileged attacker with network access via HTTP to fully compromise Oracle iSupport, leading to complete takeover of the product. The vulnerability impacts confidentiality, integrity, and availability of the affected system. Additionally, the attack may have a scope change effect, potentially impacting other Oracle products beyond iSupport.

Oracle has not explicitly confirmed a dedicated patch for CVE-2026-46944 but includes it in the June 2026 Critical Security Patch Update advisory, which contains numerous security fixes. Customers are strongly advised to apply the June 2026 Critical Security Patch Update promptly to mitigate this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges from users who do not require them, with the caveat that these actions may disrupt application functionality.