CVE-2026-46959: Vulnerability in the Oracle Subledger Accounting product of Oracle E-Business Suite (component: Internal Operations)

Synopsis

An unspecified vulnerability in the Internal Operations component of Oracle Subledger Accounting (part of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged attacker with network access over HTTP to fully compromise the application. Exploitation requires overcoming high attack complexity conditions but does not require any victim interaction. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of Oracle Subledger Accounting. No fix version has been published yet; HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as Oracle releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Subledger Accounting service over the network via HTTP; no local or physical access is assumed.

• AuthenticationRequired

  Any low-privilege account on the system is sufficient; the attacker does not need administrative credentials.

• Victim interactionNot required

  No action from a logged-in user or administrator is needed to trigger the vulnerability.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning the attacker must meet specific environmental conditions or timing requirements beyond simply sending a request.

Blast Radius

• A successful attacker reads all data accessible to Oracle Subledger Accounting, including financial journals, subledger entries, and any stored credentials or session material.
• The attacker can modify or delete persisted accounting records, subledger balances, and configuration data.
• The attacker can crash or render the Oracle Subledger Accounting service unavailable, disrupting financial close and reporting workflows.
• Because the CVSS description notes full application takeover, the attacker gains persistent execution capability within the compromised application context.