CVE-2026-46945 is a vulnerability in the Oracle iSupport component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a high privileged attacker with network access over HTTP to compromise Oracle iSupport, with potential scope change affecting other Oracle products. The vulnerability is rated critical with a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating network exploitable with low attack complexity, requiring high privileges, no user interaction, and causing complete confidentiality, integrity, and availability loss. Oracle’s June 2026 Critical Security Patch Update advisory references this vulnerability among 245 fixes but does not provide a separate patch link or explicit remediation level for this CVE. Oracle recommends applying the full Critical Security Patch Update without delay. Workarounds include blocking required network protocols and removing unnecessary privileges, though these may impact functionality.

Successful exploitation allows a high privileged attacker with network access via HTTP to take over Oracle iSupport, resulting in complete compromise of confidentiality, integrity, and availability of the affected component. The vulnerability may also impact additional Oracle products beyond iSupport due to scope change. This can lead to unauthorized control and potential disruption of Oracle E-Business Suite operations.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which includes fixes for this vulnerability among others. No explicit standalone patch or temporary fix is provided for CVE-2026-46945. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and removing unnecessary privileges from users, though these mitigations may affect application functionality. Customers should follow Oracle’s official advisory and patch documentation for detailed instructions.