CVE-2026-46915: Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Production)

Synopsis

An unspecified high-severity vulnerability affects the Production component of Oracle Complex Maintenance, Repair and Overhaul (CMRO), part of Oracle E-Business Suite versions 12.2.3 through 12.2.15. The flaw is reachable over the network via HTTP and requires a low-privileged account, but exploitation is difficult due to environmental conditions the attacker must satisfy. Successful exploitation enables full takeover of the CMRO application, with scope change meaning attacks can spill over into additional products in the same environment. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the CMRO application over the network via HTTP; the service must be exposed to the attacker's network.

• AuthenticationRequired

  A low-privilege account on the system is required; anonymous access alone is not sufficient to trigger the vulnerability.

• Victim interactionNot required

  No action from a logged-in user or administrator is needed; the attacker can complete exploitation without social engineering.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must meet specific environmental conditions or race conditions beyond simple network access, making reliable exploitation harder.

Blast Radius

• A successful attacker achieves full takeover of the CMRO application, gaining the ability to read all data stored within it, including maintenance records, repair orders, and overhaul schedules.
• The attacker can modify or delete persisted data within CMRO, tampering with production records and operational configurations.
• The CVSS scope change indicates the attacker can pivot to compromise additional Oracle E-Business Suite components running in the same environment.
• The availability impact is rated High, meaning the attacker can crash or render the CMRO service unavailable, disrupting production and maintenance operations.