CVE-2026-46944: Oracle iSupport Auth Bypass Vulnerability

CVE-2026-46944 Overview

CVE-2026-46944 is a critical vulnerability in the Oracle iSupport product of Oracle E-Business Suite, within the Internal Operations component. Supported versions affected are 12.2.3 through 12.2.15. The flaw allows a high-privileged attacker with network access via HTTP to compromise Oracle iSupport. Although the vulnerability resides in Oracle iSupport, successful exploitation produces a scope change that can significantly impact additional products. Oracle disclosed this issue in its June 2026 Critical Patch Update.

Critical Impact
Successful attacks result in full takeover of Oracle iSupport, with high impact to confidentiality, integrity, and availability across additional in-scope products.

Affected Products

Oracle iSupport 12.2.3
Oracle iSupport versions 12.2.4 through 12.2.14
Oracle iSupport 12.2.15

Discovery Timeline

2026-06-17 - CVE-2026-46944 published to the National Vulnerability Database (NVD)
2026-06-18 - Last updated in NVD database
June 2026 - Oracle releases fix in the Oracle Critical Patch Update Advisory - June 2026

Technical Details for CVE-2026-46944

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle iSupport, a customer self-service application within Oracle E-Business Suite. An authenticated attacker holding high privileges can issue crafted HTTP requests to compromise the iSupport application. The flaw maps to [CWE-284] Improper Access Control, indicating that authorization checks are insufficient for the affected functionality. Exploitation requires no user interaction and operates over the network. The scope change indicates that exploitation impacts components beyond the iSupport security boundary, expanding the blast radius to other Oracle E-Business Suite modules and shared data resources. The Exploit Prediction Scoring System (EPSS) value at publication is 0.489%.

Root Cause

The root cause is improper access control within the Internal Operations component of Oracle iSupport. The application fails to enforce sufficient privilege boundaries on certain HTTP-accessible operations. As a result, a privileged user can perform actions that cross security domains, breaking the isolation between iSupport and adjacent Oracle E-Business Suite components.

Attack Vector

An attacker authenticates to Oracle iSupport with high privileges and sends crafted HTTP requests to the vulnerable Internal Operations endpoints. The request triggers operations that the access control layer should restrict. Because of the scope change, the resulting actions affect resources outside the iSupport trust boundary, enabling full takeover of the application and impacting confidentiality, integrity, and availability of related products. No specialized tooling or user interaction is required. No public proof-of-concept exploit is currently available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code is available. See the Oracle Security Alert for vendor-specific technical detail.

Detection Methods for CVE-2026-46944

Indicators of Compromise

Unexpected HTTP requests to Oracle iSupport Internal Operations endpoints originating from high-privileged accounts outside normal administrative workflows.
Audit log entries showing privileged iSupport actions that touch resources belonging to other Oracle E-Business Suite components.
Creation, modification, or escalation of accounts or roles within iSupport without a corresponding change request.

Detection Strategies

Review Oracle E-Business Suite audit and FND log tables for anomalous activity by high-privileged iSupport users.
Monitor application server access logs for unusual request patterns against iSupport Internal Operations URLs.
Correlate database-level changes with HTTP request traffic to identify privileged actions that cross product boundaries.

Monitoring Recommendations

Forward Oracle E-Business Suite application, database, and web tier logs to a centralized analytics platform for correlation.
Alert on privilege changes, configuration changes, and bulk data access events within iSupport.
Baseline normal administrative behavior and flag deviations in request volume, timing, and source IP for high-privileged accounts.

How to Mitigate CVE-2026-46944

Immediate Actions Required

Apply the fixes from the Oracle Critical Patch Update Advisory - June 2026 to all affected Oracle E-Business Suite 12.2.3 through 12.2.15 environments.
Inventory all Oracle iSupport instances and confirm patch level after deployment.
Audit accounts with high privileges in iSupport and remove unnecessary entitlements.
Restrict network access to Oracle E-Business Suite application tiers to trusted management networks where feasible.

Patch Information

Oracle released the fix as part of the June 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert for patch identifiers, prerequisites, and product-specific installation procedures applicable to Oracle E-Business Suite 12.2.3 through 12.2.15.

Workarounds

Temporarily reduce the number of accounts granted high-privilege roles within Oracle iSupport until patching is complete.
Place a web application firewall in front of the Oracle E-Business Suite application tier and restrict access to iSupport Internal Operations URLs to known administrative sources.
Enable and review Oracle E-Business Suite Sign-On Audit and Page Access Tracking to detect misuse pending patch deployment.

bash

# Configuration example: restrict iSupport Internal Operations endpoints at the reverse proxy
# Example for Apache HTTP Server fronting Oracle E-Business Suite
<Location "/OA_HTML/ibu">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>