CVE-2026-46939: Oracle Configure To Order Auth Bypass

CVE-2026-46939 Overview

CVE-2026-46939 is a high-severity vulnerability in the Oracle Configure to Order product within Oracle E-Business Suite. The flaw resides in the Supply to Order Workbench component and affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit this weakness to compromise the application. The CWE classification is [CWE-284] Improper Access Control.

Successful exploitation grants unauthorized creation, deletion, or modification of critical data, along with unauthorized read access to all Oracle Configure to Order accessible data. Oracle published the fix in its June 2026 Critical Patch Update.

Critical Impact
Authenticated remote attackers can read and modify all data accessible to Oracle Configure to Order, including business-critical supply chain and order records.

Affected Products

Oracle Configure to Order 12.2.3
Oracle Configure to Order versions 12.2.4 through 12.2.14
Oracle Configure to Order 12.2.15

Discovery Timeline

2026-06-17 - CVE-2026-46939 published to NVD
2026-06-18 - Last updated in NVD database
June 2026 - Oracle releases fix in the Critical Patch Update

Technical Details for CVE-2026-46939

Vulnerability Analysis

The vulnerability affects the Supply to Order Workbench component of Oracle Configure to Order, part of Oracle E-Business Suite. Oracle classifies the flaw as easily exploitable over the network using HTTP. An attacker requires only low-level privileges, meaning any authenticated application user can attempt exploitation without elevated roles.

Successful attacks compromise confidentiality and integrity of the application's data. Attackers can read, create, delete, or modify any data the Configure to Order module can access. Availability is not impacted according to Oracle's advisory.

The issue maps to [CWE-284] Improper Access Control, indicating that the application fails to correctly enforce authorization checks on actions exposed through the Supply to Order Workbench. The EPSS probability stands at 0.365%.

Root Cause

The root cause is improper enforcement of access control within the Supply to Order Workbench. Functionality that should be restricted to specific roles is reachable by users holding only basic application credentials. The component does not adequately validate whether the authenticated principal owns the requested resource or holds the required privilege before performing read or write operations.

Attack Vector

Exploitation requires network reachability to the Oracle E-Business Suite HTTP interface and any valid low-privilege account. The attacker issues crafted HTTP requests to Supply to Order Workbench endpoints to read or alter records the account should not access. No user interaction is required. See the Oracle Security Alert for technical advisory details.

Detection Methods for CVE-2026-46939

Indicators of Compromise

Unexpected HTTP requests from low-privileged user accounts to Supply to Order Workbench URLs within Oracle E-Business Suite.
Audit log entries showing record creation, modification, or deletion by accounts that historically perform only read operations.
Anomalous query patterns against Configure to Order tables originating from the EBS application tier.

Detection Strategies

Enable and review Oracle E-Business Suite application audit logs for Supply to Order Workbench transactions, focusing on user-to-action mismatches.
Correlate HTTP access logs from the EBS web tier with database-level audits to surface activity that bypasses expected role boundaries.
Baseline normal Configure to Order activity per user role and alert on deviations such as bulk record reads or out-of-role writes.

Monitoring Recommendations

Forward EBS application, web tier, and database audit logs to a centralized SIEM for cross-source correlation.
Monitor for repeated HTTP 200 responses on Supply to Order Workbench endpoints accessed by accounts that lack supply chain responsibilities.
Track privilege use over time to detect accounts whose access patterns expand beyond their assigned role.

How to Mitigate CVE-2026-46939

Immediate Actions Required

Apply the Oracle June 2026 Critical Patch Update to all Oracle E-Business Suite environments running Configure to Order versions 12.2.3 through 12.2.15.
Inventory all Oracle E-Business Suite instances and confirm patch levels for the Configure to Order module.
Review user accounts with access to the Supply to Order Workbench and remove unnecessary entitlements.

Patch Information

Oracle addressed CVE-2026-46939 in the June 2026 Critical Patch Update. Customers should download and apply the patch referenced in the Oracle Security Alert. Apply the fix in a test environment first, then promote to production following standard EBS change management.

Workarounds

Restrict network access to the Oracle E-Business Suite HTTP interface to trusted internal networks and VPN-connected users.
Disable or restrict access to the Supply to Order Workbench responsibilities for users who do not require it until patching is complete.
Enforce strong authentication and monitor low-privileged accounts that retain access to the Configure to Order module.

bash

# Verify Oracle E-Business Suite patch level after applying the June 2026 CPU
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<JUN2026_CPU_BUG_ID>')
 ORDER BY last_update_date DESC;
EOF