CVE-2026-46922: Vulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component: Internal Operations)

Synopsis

A high-severity vulnerability exists in the Internal Operations component of Oracle HR Intelligence, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15. The flaw is reachable over the network via HTTP and requires a high-privileged account to exploit, with no victim interaction needed. Successful exploitation gives an attacker full control over the Oracle HR Intelligence instance, impacting confidentiality, integrity, and availability. No fix version has been published; HarborGuard tracks the advisory and will make a patched rebuild available as soon as Oracle ships an upstream fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle HR Intelligence service over the network via HTTP; there is no local or physical access requirement.

• AuthenticationRequired

  A high-privileged account (such as an administrative or privileged application user) is required before the attack can proceed.

• Victim interactionNot required

  No user interaction is needed; the attacker can carry out the exploit entirely without involving another person.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special preconditions, race conditions, or environmental setup.

Blast Radius

• A successful attacker reads all data held by Oracle HR Intelligence, including employee records, compensation data, and HR operational data.
• The attacker can modify or delete persisted HR records, corrupting data integrity across the affected E-Business Suite instance.
• The attacker can crash or render the Oracle HR Intelligence service unavailable, disrupting HR operations for all users of the instance.
• The combined confidentiality, integrity, and availability impact constitutes a full takeover of the affected component.