CVE-2026-46946: Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations)

Synopsis

A critical-severity vulnerability affects the Internal Operations component of Oracle iSupport, part of Oracle E-Business Suite (versions 12.2.3 through 12.2.15). An attacker with admin-level network access over HTTP can exploit this flaw without any victim interaction, and successful exploitation results in full takeover of Oracle iSupport, with spillover impact on additional products in scope. No fix version has been published by Oracle at this time; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle iSupport service over the network via HTTP; local or physical access is not sufficient.

• AuthenticationRequired

  An admin or otherwise high-privileged account is needed; unauthenticated access alone is not sufficient to trigger this vulnerability.

• Victim interactionNot required

  No user interaction is needed; the attacker can exploit this vulnerability entirely without involving another person.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other hard-to-control environmental factors.

Blast Radius

• A successful attacker gains full control of Oracle iSupport, including the ability to read all data stored in the application such as customer records and support case contents.
• The attacker can modify or delete persisted data across Oracle iSupport, including internal operational records and configurations.
• The attacker can crash or otherwise disrupt the Oracle iSupport service, causing a denial of service for end users and support staff.
• Because the CVSS scope is changed, the attacker can pivot to compromise additional Oracle E-Business Suite products running in the same environment.