CVE-2026-46953 affects Oracle HRMS (UK) within Oracle E-Business Suite versions 12.2.3 to 12.2.15. The vulnerability allows a high privileged attacker with network access via HTTP to compromise the product, potentially leading to full system takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has published this vulnerability as part of its June 2026 Critical Security Patch Update advisory but does not explicitly confirm a dedicated patch or remediation level for this CVE. Oracle advises customers to apply the Critical Security Patch Update promptly and consider mitigating actions such as blocking network protocols or restricting privileges to reduce attack risk until patches are applied.

Successful exploitation of CVE-2026-46953 can lead to complete compromise of Oracle HRMS (UK), affecting confidentiality, integrity, and availability of the system. This could allow an attacker with high privileges and network access via HTTP to take over the affected product, potentially leading to unauthorized data access, modification, or denial of service.

Oracle recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this and other vulnerabilities. The vendor advisory does not explicitly confirm a dedicated patch for CVE-2026-46953 but includes it in the broader patch update. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges from users, though these measures may impact application functionality. Customers should follow Oracle's official guidance in the advisory at https://www.oracle.com/security-alerts/cspujun2026.html.