CVE-2026-46952 is a vulnerability in Oracle Quality (component: Internal Operations) of Oracle E-Business Suite affecting versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise Oracle Quality, potentially resulting in full product takeover. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes 245 new security patches. The vendor advisory emphasizes the importance of applying these patches without delay and suggests possible temporary mitigations such as blocking network protocols required by the attack or removing unnecessary privileges, though these may disrupt application functionality.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Quality, affecting confidentiality, integrity, and availability of the system. This means an attacker could gain unauthorized access, modify data, and disrupt service operations within Oracle Quality.

Oracle has released security patches addressing this vulnerability in the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches as soon as possible. Until patches are applied, risk may be reduced by blocking network protocols required by the attack or removing unnecessary privileges from users, but these measures may impact application functionality. Oracle recommends staying on actively supported versions and applying security patches promptly to prevent exploitation.