CVE-2026-46945: Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations)

Synopsis

A critical remote-code-execution class vulnerability affects the Internal Operations component of Oracle iSupport, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15. An attacker with administrative network access can reach the component over HTTP without any victim interaction and, if successful, achieves full takeover of Oracle iSupport, with impacts that spill over into additional products in the same environment due to a scope change in the CVSS rating. No fix version has been published by Oracle at this time; HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle iSupport service over the network via HTTP; local or physical access is not sufficient.

• AuthenticationRequired

  An administrative (high-privilege) account is needed; the attacker must already hold or obtain admin credentials before exploiting this vulnerability.

• Victim interactionNot required

  No user action is needed; the attacker interacts directly with the service and does not need to trick any legitimate user into doing anything.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and imposes no special timing, race conditions, or environmental prerequisites beyond holding valid admin credentials.

Blast Radius

• A successful attacker reads all data accessible to Oracle iSupport, including stored support tickets, internal operational records, and any credentials or session material held by the application.
• The attacker can modify or delete persisted data within Oracle iSupport, including case records, configuration, and operational state.
• The attacker can crash or render Oracle iSupport unavailable, disrupting support workflows that depend on the service.
• Because the CVSS scope is changed, a successful exploit can extend compromise into other Oracle E-Business Suite products sharing the same environment, not just the iSupport component itself.