CVE-2026-46951: Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations)

Synopsis

An unspecified vulnerability in the Internal Operations component of Oracle Quality, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15, allows a low-privileged attacker to reach the affected component over HTTP and exploit it without any victim interaction. Successful exploitation results in full takeover of Oracle Quality, giving the attacker complete read, write, and availability control over the affected installation. No fix versions have been published; HarborGuard is tracking the advisory and will surface a patched-image rebuild the moment Oracle releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Oracle Quality service over the network via HTTP; there is no requirement for local or physical access.

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker must be authenticated to the application but does not need administrative or elevated privileges.

• Victim interactionNot required

  No user interaction is needed; the attacker can carry out the exploit entirely without involving another person.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special preconditions, race conditions, or environmental factors to succeed.

Blast Radius

• A successful attacker reads all data accessible to Oracle Quality, including quality records, configuration data, and any credentials or session material stored within the component.
• The attacker can modify or delete persisted quality records and application configuration, corrupting data integrity across the affected E-Business Suite installation.
• The attacker can crash or otherwise disrupt the Oracle Quality service, making it unavailable to legitimate users.
• Because the CVSS descriptor characterizes the outcome as a full takeover, the attacker gains sustained control over the compromised component, enabling follow-on lateral movement within the E-Business Suite environment.