CVE-2026-46918: Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (component: Internal Operations)

Synopsis

A critical-severity authentication-partial-bypass leading to full system takeover affects Oracle Process Manufacturing Product Development, a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. The vulnerability is reachable over the network via HTTP by any low-privileged authenticated user, requires no victim interaction, and carries a scope-change designation meaning exploitation can spill into adjacent systems beyond the directly targeted component. Successful exploitation gives an attacker complete control over the affected installation, including full read, write, and availability impact. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle E-Business Suite HTTP endpoint over the network; there is no local or physical access requirement.

• AuthenticationRequired

  Any low-privilege account is sufficient; no administrative credentials are needed to trigger the vulnerability.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker can exploit the vulnerability entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other environmental factors.

Blast Radius

• A successful attacker reads all data accessible to the Oracle Process Manufacturing Product Development component, including process formulas, batch records, and any credentials or tokens stored within the application.
• The attacker can write or modify persisted manufacturing and product development records, corrupting production data or injecting malicious configuration.
• The attacker can crash or deny availability of the Oracle Process Manufacturing Product Development service, halting manufacturing operations.
• Because the CVSS vector carries a scope change, the attacker can pivot from the compromised component into other products sharing the same E-Business Suite environment, extending impact beyond the initial target.