CVE-2026-46942: Vulnerability in the Oracle Process Manufacturing Process Planning product of Oracle E-Business Suite (component: Internal Operations)

Synopsis

An authorization or privilege escalation vulnerability affects the Internal Operations component of Oracle Process Manufacturing Process Planning, part of Oracle E-Business Suite (versions 12.2.3 through 12.2.15). The flaw is reachable over the network via HTTP and requires only a low-privileged account, with no user interaction needed. Successful exploitation gives an attacker full control over the affected component, impacting confidentiality, integrity, and availability. No fix version has been published by Oracle; HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected service over the network via HTTP; there is no requirement for local or physical access.

• AuthenticationRequired

  Any low-privilege account with network access to the application is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  No interaction from a victim user is required; the attacker can exploit the flaw entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental factors to succeed.

Blast Radius

• A successful attacker reads all data accessible to the Oracle Process Manufacturing Process Planning component, including production plans, batch records, and any credentials or tokens stored within the application.
• The attacker can modify or delete persisted planning data, formula records, and operational configurations within the affected component.
• The attacker can crash or render the Oracle Process Manufacturing Process Planning service unavailable, disrupting manufacturing operations that depend on it.
• Combined high impact across confidentiality, integrity, and availability means a successful attack constitutes a full takeover of the affected component.