CVE-2026-46952: Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations)

Synopsis

An unspecified vulnerability in the Internal Operations component of Oracle Quality, part of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), allows a low-privileged attacker to exploit the product over HTTP without any user interaction. The attack is network-accessible and requires no complex conditions, making it straightforward to attempt. Successful exploitation results in full takeover of Oracle Quality, giving the attacker control over its confidentiality, integrity, and availability. HarborGuard is tracking this advisory for patch availability and will make a patched-image rebuild available the moment Oracle publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Quality service over the network via HTTP; no local or physical access is needed.

• AuthenticationRequired

  Any low-privilege account is sufficient; the attacker does not need administrative or elevated credentials.

• Victim interactionNot required

  No action from a logged-in user or administrator is needed to complete the attack.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or special environmental factors required.

Blast Radius

• A successful attacker reads all data stored within Oracle Quality, including quality records, inspection results, and any credentials or tokens held by the application.
• The attacker can modify or delete persisted quality data, corrupting audit trails and production records.
• The attacker can crash or render Oracle Quality unavailable, disrupting any business processes that depend on it.
• Because the CVSS describes a full application takeover, the attacker gains the ability to pivot through Oracle Quality's internal service connections to adjacent E-Business Suite components.