CVE-2026-46923: Oracle E-Business Suite Privilege Escalation

CVE-2026-46923 Overview

CVE-2026-46923 is an authorization vulnerability in the Oracle Public Sector Financials (International) product within Oracle E-Business Suite. The flaw resides in the Authorization component and affects supported versions 12.2.3 through 12.2.15. A high-privileged attacker with network access via HTTP can exploit this weakness to compromise the affected product. The vulnerability introduces a scope change, meaning successful exploitation impacts resources beyond the vulnerable component. Oracle disclosed the issue in its July 2026 Critical Patch Update.

Critical Impact
Successful exploitation results in full takeover of Oracle Public Sector Financials (International), with confidentiality, integrity, and availability impacts extending to additional Oracle E-Business Suite components.

Affected Products

Oracle E-Business Suite – Public Sector Financials (International) version 12.2.3
Oracle E-Business Suite – Public Sector Financials (International) versions 12.2.4 through 12.2.14
Oracle E-Business Suite – Public Sector Financials (International) version 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-46923 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-46923

Vulnerability Analysis

CVE-2026-46923 is categorized as an Improper Access Control weakness [CWE-284] affecting the Authorization component of Oracle Public Sector Financials (International). The vulnerability allows an authenticated attacker holding high privileges to bypass authorization boundaries over HTTP. Because the flaw produces a scope change, exploitation of one component impacts security-relevant resources managed by other components in the Oracle E-Business Suite stack. Oracle rates the outcome as a full takeover of the affected product, with confidentiality, integrity, and availability all impacted.

Root Cause

The underlying defect stems from improper enforcement of access control policies in the Authorization component. Authorization checks fail to restrict privileged operations to their intended trust boundary. As a result, a high-privileged principal can perform actions that should be reserved for other trust contexts within Oracle E-Business Suite.

Attack Vector

The attack is delivered remotely over HTTP against the Oracle E-Business Suite web tier. The attacker must already possess high privileges within the application, and exploitation is characterized as difficult. No user interaction is required. Because the scope changes upon exploitation, downstream Oracle E-Business Suite modules integrated with Public Sector Financials (International) may be affected. Oracle has not published proof-of-concept code, and no public exploit is available at the time of disclosure. Refer to the Oracle Security Alert July 2026 for authoritative technical context.

Detection Methods for CVE-2026-46923

Indicators of Compromise

Unexpected privileged transactions in Oracle Public Sector Financials (International) audit tables originating from accounts that do not typically perform administrative operations.
HTTP requests to Oracle E-Business Suite endpoints containing unusual authorization parameters or targeting configuration URLs outside normal user workflows.
Cross-module changes in E-Business Suite that correlate in time with activity in the Public Sector Financials (International) component, indicating scope-change exploitation.

Detection Strategies

Enable and forward Oracle E-Business Suite Sign-On Audit and Page Access Tracking logs to a central analytics platform for behavioral baselining.
Alert on high-privilege user sessions that perform authorization-sensitive actions outside documented change windows.
Correlate database-level FND_USER and FND_RESPONSIBILITY changes with concurrent HTTP session activity to identify anomalous privilege use.

Monitoring Recommendations

Continuously monitor Oracle HTTP Server access logs for repeated 4xx/5xx responses on /OA_HTML/ and authorization-related URIs.
Track administrator responsibility assignments and role delegations for unauthorized modifications.
Review network flows to the E-Business Suite application tier for unexpected internal sources initiating privileged sessions.

How to Mitigate CVE-2026-46923

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite 12.2.3 through 12.2.15 environments.
Inventory accounts with high privileges in Public Sector Financials (International) and revoke unnecessary access.
Restrict network exposure of the E-Business Suite application tier to trusted management networks.

Patch Information

Oracle addressed CVE-2026-46923 in the July 2026 Critical Patch Update. Administrators should follow the guidance in the Oracle Security Alert July 2026 and apply the corresponding patch for their Oracle E-Business Suite release. No effective workaround is documented; patching is the authoritative remediation.

Workarounds

Enforce strict separation of duties so no single account holds high privileges across multiple E-Business Suite modules.
Require multi-factor authentication and jump-host access for privileged E-Business Suite users to raise the exploitation bar.
Place a web application firewall in front of Oracle HTTP Server and restrict administrative URIs to allow-listed source addresses.

bash

# Configuration example: restrict administrative access at the reverse proxy
# (adapt to your Oracle HTTP Server / load balancer syntax)
<Location /OA_HTML/>
    Order deny,allow
    Deny from all
    Allow from 10.10.0.0/24    # trusted admin subnet
</Location>