CVE-2026-46956: Oracle Property Manager Privilege Escalation

CVE-2026-46956 Overview

CVE-2026-46956 is a high-severity vulnerability in the Oracle Property Manager product of Oracle E-Business Suite, within the Internal Operations component. The flaw affects supported versions 12.2.3 through 12.2.15. An authenticated attacker with high privileges and network access via HTTP can exploit this weakness to compromise Oracle Property Manager. Successful exploitation results in full takeover of the application, impacting confidentiality, integrity, and availability. The vulnerability is classified under CWE-284: Improper Access Control.

Critical Impact
Successful exploitation grants complete takeover of Oracle Property Manager, exposing tenant data, lease information, and financial records to compromise.

Affected Products

Oracle Property Manager version 12.2.3
Oracle Property Manager versions 12.2.4 through 12.2.14
Oracle Property Manager version 12.2.15

Discovery Timeline

2026-06-17 - CVE-2026-46956 published to NVD
2026-06-18 - Last updated in NVD database
2026-06-18 - EPSS score recorded at 0.43% (percentile 34.27)

Technical Details for CVE-2026-46956

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Property Manager, a module of Oracle E-Business Suite used to manage real estate portfolios, leases, and space allocations. An attacker leveraging existing high-privileged credentials can issue crafted HTTP requests to the application and gain control of the Property Manager module. The flaw maps to CWE-284: Improper Access Control, indicating that authorization logic does not adequately restrict privileged operations.

Because Oracle Property Manager stores sensitive tenant, lease, and financial information, a successful takeover exposes business-critical data and downstream EBS integrations. The exploit prerequisites include valid authenticated access, which limits the attacker pool to insiders or adversaries who have already harvested privileged credentials through phishing or credential theft.

Root Cause

The root cause is improper access control within the Internal Operations component. The application fails to enforce sufficient authorization checks when processing certain HTTP requests, allowing privileged callers to invoke operations that result in full module compromise. Oracle has not disclosed the specific function or endpoint affected in the public advisory.

Attack Vector

The attack is launched over the network using HTTP. The attacker must already possess high-privilege credentials within the Oracle E-Business Suite environment. No user interaction is required, and exploitation complexity is low. Given the network attack surface and authenticated requirement, lateral movement and credential abuse are the most likely exploitation paths.

No public proof-of-concept code or exploit is available at the time of writing. Refer to the Oracle Critical Patch Update Advisory for vendor-supplied technical context.

Detection Methods for CVE-2026-46956

Indicators of Compromise

Unexpected HTTP requests from authenticated privileged sessions targeting Property Manager Internal Operations endpoints.
Unusual administrative actions or configuration changes within Oracle Property Manager modules outside change-management windows.
New or modified responsibilities, menus, or function security records assigned to privileged EBS accounts.

Detection Strategies

Enable Oracle E-Business Suite Sign-On Audit and Page Access Tracking to record privileged user activity against Property Manager URLs.
Correlate web application server access logs with EBS audit tables (FND_LOGINS, FND_LOGIN_RESPONSIBILITIES) to identify anomalous privileged access.
Baseline normal Property Manager usage by user, time of day, and source IP, then alert on deviations.

Monitoring Recommendations

Forward EBS application, database, and web tier logs to a centralized SIEM for correlation across tiers.
Monitor for privileged account logins from new geolocations, devices, or service accounts not associated with Property Manager workflows.
Track failed authorization events and HTTP 500 responses from Property Manager endpoints, which may indicate exploitation attempts.

How to Mitigate CVE-2026-46956

Immediate Actions Required

Apply the patches referenced in the Oracle Critical Patch Update of June 2026 to all affected Oracle E-Business Suite 12.2.x environments.
Inventory all Oracle Property Manager deployments and confirm version levels between 12.2.3 and 12.2.15.
Review and reduce the number of accounts holding high-privilege responsibilities in Property Manager.
Rotate credentials for privileged EBS users and enforce multi-factor authentication on administrative access.

Patch Information

Oracle addressed CVE-2026-46956 in the June 2026 Critical Patch Update. Customers should download and apply the Property Manager patches listed in the Oracle Security Alert. Apply patches in a test environment first, then promote through standard EBS change-management procedures.

Workarounds

Restrict network access to the Oracle E-Business Suite middle tier to trusted management networks using firewall and reverse proxy rules.
Temporarily revoke Property Manager Internal Operations responsibilities from non-essential privileged users until patching is complete.
Enable detailed auditing on Property Manager menus and functions to detect misuse during the patch window.

bash

# Verify Property Manager patch level via SQL*Plus after applying the CPU
sqlplus apps/<password>@<SID> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<JUN2026_CPU_PATCH_ID>')
 ORDER BY last_update_date DESC;
EXIT;
EOF