CVE-2026-46837: Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Security)

Synopsis

A SQL-based vulnerability in the Security component of Oracle Flow Manufacturing (part of Oracle E-Business Suite, versions 12.2.9 through 12.2.15) allows a low-privileged, authenticated attacker to reach the product over the network and fully compromise it. No victim interaction is required, and the exploit is straightforward enough that Oracle rates it as easily exploitable. Successful exploitation gives the attacker full control over the affected Oracle Flow Manufacturing instance, covering data read, data write, and service availability. No fix version has been published yet; HarborGuard is actively tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Oracle Flow Manufacturing service over the network via SQL; there is no local-only constraint.

• AuthenticationRequired

  Any low-privilege account on the system is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  The attacker does not need to involve or trick any other user to carry out the attack.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout knowledge, or other environmental prerequisites.

Blast Radius

• A successful attacker reads all data accessible to the Oracle Flow Manufacturing application, including production schedules, bills of materials, work orders, and any credentials or session tokens stored in the database.
• The attacker can write or modify persisted records in Oracle Flow Manufacturing, altering manufacturing plans, work-in-progress data, or routing configurations.
• The attacker can crash or render the Oracle Flow Manufacturing service unavailable, disrupting production planning and shop-floor execution workflows.
• Because the CVSS scope is full system takeover, the attacker gains the ability to pivot from the compromised application tier to any backend database or adjacent E-Business Suite component the application account can reach.