CVE-2026-46928: Vulnerability in the Oracle Spares Management product of Oracle E-Business Suite (component: Internal Operations)

Synopsis

An unspecified vulnerability in the Internal Operations component of Oracle Spares Management (part of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a network-accessible attacker with a low-privilege account to fully compromise the application. The flaw is reachable over HTTPS without requiring any interaction from another user, and successful exploitation results in complete takeover of Oracle Spares Management, giving the attacker full read, write, and availability control over the system. No fix version has been published by Oracle at this time; HarborGuard is tracking the advisory and will surface a patched-image rebuild the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Spares Management service over the network via HTTPS; no local or physical access is needed.

• AuthenticationRequired

  Any low-privilege account on the system is sufficient; no administrative credentials are required.

• Victim interactionNot required

  The attack completes without any action from another user or administrator.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions or specific environmental factors need to align.

Blast Radius

• A successful attacker reads all data accessible to Oracle Spares Management, including internal operations records, parts inventory data, and any stored credentials or session tokens.
• The attacker can modify or delete persisted records within Oracle Spares Management, corrupting inventory, work orders, or operational data.
• The attacker can crash or render the Oracle Spares Management service unavailable, disrupting supply chain and maintenance operations that depend on it.
• The combination of high confidentiality, integrity, and availability impact means the attacker effectively takes over the application instance entirely.