CVE-2026-46967: Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component: Authorization)

Synopsis

An authorization bypass vulnerability affects the Authorization component of Oracle Public Sector Financials (International), part of Oracle E-Business Suite versions 12.2.3 through 12.2.15. The flaw is reachable over the network via HTTP and requires only a low-privileged account, with no victim interaction needed. Successful exploitation gives an attacker full control over the affected instance, including read, write, and denial-of-service capabilities across all data handled by the application. No fix version has been published by Oracle; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Public Sector Financials service over the network via HTTP; no local or physical access is required.

• AuthenticationRequired

  The attacker must hold a valid low-privilege account on the application; unauthenticated access is not sufficient to trigger the vulnerability.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker can exploit the flaw directly without any victim participation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• A successful attacker reads all data held by the Oracle Public Sector Financials instance, including financial records, budget data, and user credentials.
• The attacker writes or modifies persisted financial records and configuration data, enabling fraud or corruption of public-sector accounting information.
• The attacker crashes or degrades the Oracle Public Sector Financials service, causing a denial of service for all users of the affected deployment.
• Full application takeover means the attacker can pivot to other systems reachable from the compromised E-Business Suite host.