CVE-2026-46945: Oracle iSupport Privilege Escalation Flaw

CVE-2026-46945 Overview

CVE-2026-46945 is a critical vulnerability in the Oracle iSupport product of Oracle E-Business Suite, specifically within the Internal Operations component. The flaw affects supported versions 12.2.3 through 12.2.15. An authenticated attacker with high privileges and network access via HTTP can compromise Oracle iSupport. The vulnerability carries a scope change, meaning successful exploitation can impact additional products beyond iSupport itself. Successful attacks result in full takeover of Oracle iSupport with confidentiality, integrity, and availability impacts.

Critical Impact
Successful exploitation leads to complete takeover of Oracle iSupport and may impact additional products through scope change, affecting confidentiality, integrity, and availability.

Affected Products

Oracle iSupport version 12.2.3
Oracle iSupport versions 12.2.4 through 12.2.14
Oracle iSupport version 12.2.15

Discovery Timeline

2026-06-17 - CVE-2026-46945 published to NVD
2026-06-17 - Last updated in NVD database
June 2026 - Oracle releases Critical Patch Update addressing the vulnerability

Technical Details for CVE-2026-46945

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle iSupport, a self-service customer support portal within Oracle E-Business Suite. An attacker with high-privilege authenticated access can issue crafted HTTP requests to compromise the iSupport application. The flaw is classified under [CWE-284] Improper Access Control, indicating insufficient authorization checks on privileged operations.

The scope change designation in the CVSS vector indicates that exploitation can affect resources beyond the vulnerable component. This means attackers can pivot from iSupport into other Oracle E-Business Suite modules sharing the same trust boundary. The EPSS probability is 0.453% with a percentile of 35.896, reflecting limited current exploitation activity.

Root Cause

The root cause stems from improper access control within the iSupport Internal Operations component. The application fails to enforce authorization restrictions on functionality available to high-privileged users, allowing them to perform operations exceeding their intended permissions. Oracle has not publicly disclosed the specific code paths involved.

Attack Vector

The attack vector is network-based over HTTP with low attack complexity. The attacker must hold high-privilege credentials within the iSupport environment but does not require user interaction. Once authenticated, the attacker sends malicious HTTP requests to vulnerable endpoints within the Internal Operations component. The scope change permits lateral impact across related E-Business Suite components.

No verified public proof-of-concept code is available. Refer to the Oracle Security Alert June 2026 for vendor technical details.

Detection Methods for CVE-2026-46945

Indicators of Compromise

Unexpected HTTP requests to Oracle iSupport Internal Operations endpoints originating from high-privileged accounts.
Anomalous administrative actions within Oracle iSupport logs, particularly outside normal operational windows.
Cross-module access patterns where iSupport sessions interact with adjacent Oracle E-Business Suite components.

Detection Strategies

Monitor Oracle E-Business Suite audit logs (FND_LOG_MESSAGES, FND_LOGINS) for privileged session activity targeting iSupport URLs.
Deploy web application firewall rules to inspect HTTP traffic to iSupport endpoints for malformed parameters and unauthorized function calls.
Correlate authentication events with subsequent privileged actions to identify suspicious privilege use chains.

Monitoring Recommendations

Enable detailed HTTP request logging on the Oracle HTTP Server fronting E-Business Suite and forward logs to a centralized SIEM.
Track changes to Oracle iSupport responsibility assignments and role grants for privileged users.
Alert on access to Internal Operations functions from accounts that do not normally use that component.

How to Mitigate CVE-2026-46945

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert June 2026 to all affected Oracle iSupport instances.
Audit and reduce the number of accounts holding high-privilege roles in Oracle iSupport.
Restrict network access to Oracle E-Business Suite management interfaces to trusted administrative networks only.

Patch Information

Oracle addressed CVE-2026-46945 in the June 2026 Critical Patch Update. Administrators should review the Oracle Security Alert June 2026 and apply the patches corresponding to their installed Oracle E-Business Suite version 12.2.3 through 12.2.15. Patching is the only complete remediation, as the flaw resides in product code.

Workarounds

Temporarily disable the Oracle iSupport Internal Operations component for users who do not require it until patching completes.
Enforce multi-factor authentication for all high-privilege Oracle E-Business Suite accounts to raise the bar for credential abuse.
Place Oracle iSupport behind a reverse proxy or WAF and restrict access to authenticated VPN sessions where feasible.

bash

# Example: Restrict Oracle iSupport HTTP access via firewall (iptables)
# Allow only trusted admin subnet to reach the iSupport port
iptables -A INPUT -p tcp --dport 8000 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP