CVE-2026-46915: Oracle MRO Auth Bypass Vulnerability

CVE-2026-46915 Overview

CVE-2026-46915 is a high-severity access control vulnerability [CWE-284] in the Production component of Oracle Complex Maintenance, Repair and Overhaul, part of Oracle E-Business Suite. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can compromise the product, although exploitation requires high attack complexity. Successful attacks result in full takeover of Oracle Complex Maintenance, Repair and Overhaul and a scope change that can affect additional Oracle E-Business Suite components.

Critical Impact
Authenticated attackers can take over the Oracle Complex Maintenance, Repair and Overhaul application and pivot to impact other E-Business Suite products through scope-changing attacks over HTTP.

Affected Products

Oracle Complex Maintenance, Repair and Overhaul version 12.2.3
Oracle Complex Maintenance, Repair and Overhaul versions 12.2.4 through 12.2.14
Oracle Complex Maintenance, Repair and Overhaul version 12.2.15

Discovery Timeline

2026-06-17 - CVE-2026-46915 published to the National Vulnerability Database (NVD)
2026-06-18 - CVE-2026-46915 last updated in the NVD database
June 2026 - Addressed in the Oracle Critical Patch Update advisory

Technical Details for CVE-2026-46915

Vulnerability Analysis

The vulnerability resides in the Production component of Oracle Complex Maintenance, Repair and Overhaul (CMRO), an industry-specific application that runs on top of the Oracle E-Business Suite stack. The flaw is classified under [CWE-284] (Improper Access Control), indicating that the application fails to correctly enforce authorization on a network-accessible interface. An authenticated attacker with low privileges and HTTP access to the application can leverage the missing or insufficient access control to escalate access and assume control of the CMRO instance.

Oracle documents the impact as a scope change, meaning the vulnerable component can be abused to affect resources beyond its own security boundary. In practice, this means a successful attacker can pivot from CMRO into adjacent Oracle E-Business Suite modules that share the underlying middle tier and database, broadening the blast radius of any single compromised account.

The Exploit Prediction Scoring System (EPSS) currently rates the probability of exploitation in the next 30 days at 0.301%. No public proof-of-concept code or in-the-wild exploitation has been reported at the time of publication.

Root Cause

The root cause is improper access control within the Production functionality of CMRO. The application does not adequately verify that the authenticated session is authorized to perform sensitive operations exposed over HTTP, allowing a low-privileged user to execute actions reserved for higher-privileged roles.

Attack Vector

Exploitation occurs remotely over HTTP against the Oracle E-Business Suite web tier. The attacker must hold valid low-privileged credentials in the target environment, and the attack chain requires specific conditions that raise complexity. Once those conditions are met, the attacker can issue crafted requests to the CMRO Production component to seize control of the application and impact connected modules.

No verified exploit code is publicly available. Refer to the Oracle Critical Patch Update advisory for vendor-confirmed technical details.

Detection Methods for CVE-2026-46915

Indicators of Compromise

Unexpected privileged actions performed by low-privileged CMRO user accounts in Oracle E-Business Suite audit logs.
HTTP requests to CMRO Production endpoints originating from accounts that have no operational reason to access those URLs.
Configuration or workflow changes in adjacent E-Business Suite modules that correlate in time with CMRO activity from a single user session.

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and Page Access Tracking to surface anomalous navigation into CMRO Production functions.
Correlate web-tier access logs with database FND_LOGINS and FND_LOGIN_RESPONSIBILITIES records to identify privilege mismatches between session role and invoked function.
Baseline normal CMRO usage per responsibility and alert on deviations such as new IP ranges, off-hours activity, or rapid sequential access to production records.

Monitoring Recommendations

Forward Oracle E-Business Suite application, web-tier, and database audit logs to a centralized analytics platform for long-term retention and correlation.
Monitor for unusual HTTP POST volumes against CMRO module URLs and for session reuse across distinct source addresses.
Track changes to Oracle responsibilities, menus, and function security to detect unauthorized modifications that may follow a successful takeover.

How to Mitigate CVE-2026-46915

Immediate Actions Required

Apply the fixes from the Oracle Critical Patch Update advisory to all affected Oracle E-Business Suite 12.2 environments running CMRO.
Inventory accounts with access to Oracle Complex Maintenance, Repair and Overhaul and remove unnecessary CMRO responsibilities from low-privileged users.
Rotate credentials for service and integration accounts that interact with CMRO, particularly those with broad responsibility assignments.
Restrict network access to the Oracle E-Business Suite web tier so that only trusted internal networks and authenticated users can reach CMRO endpoints.

Patch Information

Oracle addressed CVE-2026-46915 in the June 2026 Critical Patch Update. Customers running Oracle E-Business Suite 12.2.3 through 12.2.15 must apply the patch bundle referenced in the Oracle Security Alert. Oracle generally provides patches only for supported product releases, so customers on unsupported versions should upgrade before patching.

Workarounds

Place the Oracle E-Business Suite web tier behind a web application firewall and restrict CMRO Production URLs to a narrow allowlist of source networks until patches are applied.
Temporarily revoke CMRO Production responsibilities from accounts that do not require them and require step-up authentication for the remaining users.
Increase audit verbosity on CMRO function security and review logs daily until the Critical Patch Update is deployed.

bash

# Example: verify the applied Oracle E-Business Suite patch level after CPU application
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<JUN2026_CPU_BUG_ID>')
 ORDER BY last_update_date DESC;
EXIT;
EOF