CVE-2026-46944: Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations)

Synopsis

A critical-severity vulnerability affects the Internal Operations component of Oracle iSupport, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15. The flaw is reachable over the network via HTTP and requires a high-privileged account to exploit, but no victim interaction is needed. Successful exploitation gives an attacker full control over Oracle iSupport and can spill over to compromise additional products in the same environment, enabling complete confidentiality loss, data tampering, and service disruption. No upstream fix version has been published; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment Oracle ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle iSupport service over the network via HTTP; no local or physical access to the host is required.

• AuthenticationRequired

  A high-privileged account (such as an administrator-level credential) is needed before the vulnerability can be triggered.

• Victim interactionNot required

  No action from any other user or victim is necessary; the attacker can exploit this entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• A successful attacker gains full read access to data stored in Oracle iSupport, including internal support records, user data, and any credentials or session tokens held by the application.
• The attacker can modify or delete persisted data within Oracle iSupport, including case records, configuration, and operational data.
• The attacker can crash or render Oracle iSupport unavailable, disrupting internal support operations.
• Because the CVSS scope is changed, the attacker can pivot to compromise additional products sharing the same E-Business Suite environment, extending the impact well beyond Oracle iSupport itself.