CVE-2026-46931: Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Internal Operations)

Synopsis

This is a high-severity vulnerability in the Internal Operations component of Oracle Enterprise Asset Management, part of Oracle E-Business Suite (versions 12.2.6 through 12.2.15). An attacker with a low-privilege account and HTTP network access can exploit this without any victim interaction, making it straightforward to trigger remotely. Successful exploitation results in full takeover of the affected Oracle Enterprise Asset Management instance, giving the attacker read, write, and availability control over the system. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Enterprise Asset Management service over the network via HTTP; there is no local or physical access requirement.

• AuthenticationRequired

  Any low-privilege account on the system is sufficient; no admin or elevated credentials are needed to trigger the vulnerability.

• Victim interactionNot required

  No user action is needed; the attacker can exploit this entirely on their own without involving another person.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental setup.

Blast Radius

• A successful attacker reads all data stored in Oracle Enterprise Asset Management, including asset records, maintenance histories, and any credentials or session tokens held by the application.
• The attacker can write to or modify persisted asset management data, including work orders, asset configurations, and operational records.
• The attacker can crash or render the Oracle Enterprise Asset Management service unavailable, disrupting maintenance and operations workflows that depend on it.
• Because the CVSS describes a full system takeover, the attacker gains the equivalent of application-level control, enabling persistent access and lateral movement within the E-Business Suite environment.