CVE-2026-46972 is a vulnerability in the Internal Operations component of Oracle Outsourced Mfg for Discrete Industries within Oracle E-Business Suite. It affects versions 12.2.3 through 12.2.15. The vulnerability allows an attacker with low privileges and network access via HTTP to compromise the product, potentially resulting in full takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update. The vendor advisory emphasizes the importance of applying patches promptly and suggests possible temporary mitigations such as blocking network protocols or removing unnecessary privileges, though these may affect application functionality.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Outsourced Mfg for Discrete Industries, affecting confidentiality, integrity, and availability of the system. An attacker with low privileges and network access via HTTP can escalate control, potentially taking over the affected product instance.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers are strongly advised to apply this patch without delay. Until the patch is applied, risk may be reduced by blocking network protocols required for exploitation or by removing unnecessary privileges from users, though these measures may disrupt normal application operations. Patch status is confirmed by the vendor advisory; applying the official patch is the recommended remediation.