CVE-2026-46970: Vulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component: Internal Operations)

Synopsis

An unspecified vulnerability in the Internal Operations component of Oracle HR Intelligence (part of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is reachable over the network via HTTP. Exploitation requires a high-privileged account but no victim interaction, and successful exploitation results in full takeover of the Oracle HR Intelligence instance, including complete loss of confidentiality, integrity, and availability. No fix versions have been published by Oracle; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle HR Intelligence service over the network via HTTP; there is no local or physical access requirement.

• AuthenticationRequired

  A high-privileged account (such as an Oracle EBS administrator) is needed; low-privilege or anonymous access is not sufficient.

• Victim interactionNot required

  No user action is needed; the attacker can exploit the vulnerability entirely on their own initiative.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• A successful attacker reads all data accessible to the Oracle HR Intelligence application, including employee records, compensation data, and internal HR reports.
• A successful attacker modifies or deletes persisted HR data, including payroll configurations, employee records, and audit logs.
• A successful attacker crashes or otherwise disables the Oracle HR Intelligence service, making HR operational functions unavailable.
• Combined control over confidentiality, integrity, and availability constitutes a full application takeover within the affected E-Business Suite instance.