This vulnerability exists in the Data Removal Tool component of Oracle Human Resources within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a high privileged attacker with network access via HTTP to compromise the system, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory references a July 2026 Critical Patch Update containing many patches but does not explicitly confirm a patch for this specific vulnerability. The vulnerability is classified under CWE-284 (Improper Access Control).

Successful exploitation can lead to complete compromise of Oracle Human Resources, affecting confidentiality, integrity, and availability of the system. This could allow an attacker with high privileges and network access to take over the affected product, potentially leading to unauthorized data access, modification, or disruption of service.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses numerous vulnerabilities across Oracle products. However, the advisory content does not explicitly confirm a patch or fix for CVE-2026-46954. Customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply relevant patches promptly. Until a specific patch is confirmed, organizations should ensure that only trusted high privileged users have network access to Oracle Human Resources and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.