CVE-2026-46958: Vulnerability in the Oracle Subledger Accounting product of Oracle E-Business Suite (component: Internal Operations)

Synopsis

An unspecified vulnerability in the Internal Operations component of Oracle Subledger Accounting (part of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged attacker with network access via HTTP to compromise the application. Exploitation is rated as difficult due to environmental or timing conditions, but a successful attack results in full takeover of the affected Oracle Subledger Accounting instance, impacting confidentiality, integrity, and availability. No fix version has been published yet; HarborGuard tracks the advisory and will surface a patched-image rebuild as soon as Oracle releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Subledger Accounting service over the network via HTTP; no local or physical access is required.

• AuthenticationRequired

  A low-privilege account on the target application is required; unauthenticated access is not sufficient to trigger this vulnerability.

• Victim interactionNot required

  The attacker does not need any user or administrator to interact with a link, file, or prompt to complete the attack.

• Attack complexityDetail

  Attack complexity is rated HIGH, meaning the exploit depends on specific environmental conditions, timing, or configuration factors that the attacker cannot fully control and may need to attempt repeatedly.

Blast Radius

• A successful attacker reads all data accessible to the Oracle Subledger Accounting application, including accounting entries, journal lines, and associated financial records.
• A successful attacker modifies or deletes persisted accounting data, including subledger journal entries and internal operational records.
• A successful attacker crashes or renders unavailable the Oracle Subledger Accounting service, disrupting financial close and reporting workflows.
• Because the CVE description characterizes the outcome as full application takeover, the attacker gains the ability to execute arbitrary operations within the application context.