CVE-2026-46946 is a vulnerability in the Oracle iSupport component of Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.15. It allows a high privileged attacker with network access over HTTP to compromise Oracle iSupport, resulting in full takeover of the product. The vulnerability has a CVSS 3.1 score of 9.1, indicating critical impact on confidentiality, integrity, and availability. The vulnerability's exploitation may also impact other Oracle products (scope change). Oracle's June 2026 Critical Security Patch Update advisory references this vulnerability among 245 security patches but does not explicitly confirm the availability of a patch for this specific CVE in the provided content. Oracle recommends applying patches promptly and suggests mitigating risk by blocking required network protocols and removing unnecessary privileges until patches are applied.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle iSupport, affecting confidentiality, integrity, and availability of the system. Due to scope change, additional Oracle products may also be impacted by attacks leveraging this vulnerability. The high CVSS score (9.1) reflects the critical nature and potential severity of the compromise.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this vulnerability. Until patches are applied, risk can be reduced by blocking network protocols required for exploitation and removing unnecessary privileges from users who do not need them. These mitigations may impact application functionality, so they should be implemented carefully. Patch status is not explicitly confirmed in the advisory content provided; customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.