CVE-2026-46956: Vulnerability in the Oracle Property Manager product of Oracle E-Business Suite (component: Internal Operations)

Synopsis

An unspecified vulnerability in the Internal Operations component of Oracle Property Manager (part of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a remote, authenticated attacker with administrative privileges to compromise the application over HTTP. No victim interaction is required, and exploitation is straightforward once the attacker holds a high-privileged account. Successful exploitation gives the attacker full control over Oracle Property Manager, affecting confidentiality, integrity, and availability. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Property Manager service over a network connection via HTTP; there is no purely local exploitation path.

• AuthenticationRequired

  A high-privileged (administrative) account is required; the attacker cannot exploit this without first obtaining or compromising such credentials.

• Victim interactionNot required

  No action from any other user or victim is needed to trigger the vulnerability.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other hard-to-control environmental factors.

Blast Radius

• A successful attacker reads all data accessible to Oracle Property Manager, including lease records, property details, and any stored credentials or session tokens.
• The attacker can modify or delete persisted property management records, financial data, and configuration within the application.
• The attacker can crash or render the Oracle Property Manager service unavailable, disrupting business operations that depend on it.
• Combined confidentiality, integrity, and availability impact effectively constitutes a full application takeover.