CVE-2026-46959 is a vulnerability in the Internal Operations component of Oracle Subledger Accounting within Oracle E-Business Suite versions 12.2.3 through 12.2.15. The flaw allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover of Oracle Subledger Accounting. The vulnerability has a CVSS 3.1 score of 7.5, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update. The vendor advisory emphasizes the importance of applying these patches promptly and notes that failure to patch has led to successful attacks on previously disclosed vulnerabilities. No specific patch version is stated for this vulnerability alone, but it is included in the cumulative update. Temporary mitigations include blocking relevant network protocols and removing unnecessary privileges, though these may impact functionality.

Successful exploitation can result in complete compromise of Oracle Subledger Accounting, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected component, potentially leading to unauthorized access and control over accounting operations within Oracle E-Business Suite.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability among others. Customers are strongly advised to apply this update promptly to remediate the issue. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and removing unnecessary privileges from users. These mitigations may affect application functionality, so patching is the recommended solution. Patch status is not explicitly detailed for this specific vulnerability, so customers should refer to the Oracle June 2026 Critical Security Patch Update advisory for exact patch availability and installation instructions.