CVE-2026-46973 is a vulnerability in the Internal Operations component of Oracle Outsourced Mfg for Discrete Industries within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to full system takeover. The vulnerability is rated with a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting high confidentiality, integrity, and availability impacts. Oracle has included this vulnerability in its June 2026 Critical Security Patch Update, which contains 245 security patches across multiple products. While no explicit patch link for this specific vulnerability is provided, Oracle strongly advises customers to apply the CSPU without delay. Mitigation options before patching include blocking network protocols required for exploitation and removing unnecessary privileges from users, though these may affect application functionality.

Successful exploitation of this vulnerability can result in complete compromise (takeover) of Oracle Outsourced Mfg for Discrete Industries, impacting confidentiality, integrity, and availability of the affected system. The attacker requires only low privileges and network access via HTTP, making the vulnerability easily exploitable. This could lead to unauthorized access, data breaches, and disruption of business operations.

Oracle has not provided a standalone patch for this vulnerability but has included it in the June 2026 Critical Security Patch Update (CSPU). Customers are strongly advised to apply the June 2026 CSPU promptly to remediate this and other vulnerabilities. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and removing unnecessary privileges from users, though these mitigations may impact application functionality. Oracle emphasizes applying patches without delay to avoid exploitation.