CVE-2026-46951 is a vulnerability in the Oracle Quality component of Oracle E-Business Suite (versions 12.2.3 to 12.2.15) that permits a low privileged attacker with network access via HTTP to compromise the product. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes 245 security patches across various Oracle products. The vendor advisory emphasizes the importance of applying these patches without delay to prevent exploitation. Workarounds include blocking network protocols required for exploitation and removing unnecessary privileges from users, though these may affect application functionality.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Quality, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over Oracle Quality, potentially leading to unauthorized access, data manipulation, and service disruption.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Until patches are applied, risk can be reduced by blocking network protocols required for the attack and by removing unnecessary privileges from users, though these measures may impact application functionality. Patch status is confirmed by the vendor advisory; therefore, applying the official patches is the recommended remediation.