CVE-2026-46958: Oracle Subledger Accounting Vulnerability

CVE-2026-46958 Overview

CVE-2026-46958 affects Oracle Subledger Accounting, a component of Oracle E-Business Suite. The flaw resides in the Internal Operations component and impacts supported versions 12.2.3 through 12.2.15. An authenticated attacker with low privileges and network access via HTTP can compromise the application. Successful exploitation results in full takeover of Oracle Subledger Accounting, with impacts to confidentiality, integrity, and availability. The weakness is categorized under [CWE-269] Improper Privilege Management. Oracle addressed the issue in its June 2026 Critical Patch Update.

Critical Impact
Successful exploitation grants full takeover of Oracle Subledger Accounting, exposing financial accounting data and operations to unauthorized read, modification, and disruption.

Affected Products

Oracle E-Business Suite — Oracle Subledger Accounting 12.2.3
Oracle E-Business Suite — Oracle Subledger Accounting versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Subledger Accounting 12.2.15

Discovery Timeline

2026-06-17 - CVE-2026-46958 published to NVD
2026-06-18 - Last updated in NVD database

Technical Details for CVE-2026-46958

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Subledger Accounting within Oracle E-Business Suite. An attacker holding a low-privileged application account can issue crafted HTTP requests to the affected component. The flaw allows that account to escalate access and assume control of the Subledger Accounting module. Successful exploitation produces high-impact loss across confidentiality, integrity, and availability. Oracle reports the attack complexity as high, indicating that specific conditions outside the attacker's control must be present for exploitation to succeed. No public proof-of-concept code or active exploitation has been reported as of publication. The EPSS probability is 0.345%, placing the CVE in the 26th percentile for near-term exploitation likelihood.

Root Cause

The issue is classified under [CWE-269] Improper Privilege Management. The Internal Operations component does not adequately enforce privilege boundaries between authenticated low-privileged users and functions reserved for administrative roles. As a result, a constrained user can reach code paths that should require elevated authorization.

Attack Vector

Exploitation requires network access over HTTP and a valid low-privileged account on the target Oracle E-Business Suite deployment. The attacker sends crafted requests to the Internal Operations component to trigger the privilege management flaw. No user interaction is required. The scope remains unchanged, but the impact within Oracle Subledger Accounting is total compromise of the application.

No verified public exploit code is available. Refer to the Oracle Critical Patch Update Advisory - June 2026 for vendor-supplied technical details.

Detection Methods for CVE-2026-46958

Indicators of Compromise

Unexpected HTTP requests from low-privileged Oracle E-Business Suite users targeting Internal Operations endpoints within Subledger Accounting.
New or modified accounting entries, journal sources, or subledger application registrations made by non-administrative accounts.
Audit log entries showing privilege role changes or function access by accounts that should not hold those privileges.

Detection Strategies

Baseline normal HTTP request patterns to Subledger Accounting URLs and alert on anomalous parameter values or access from atypical users.
Correlate Oracle E-Business Suite FND audit data with web tier access logs to identify privilege misuse across the stack.
Monitor FND_USER, FND_RESPONSIBILITY, and XLA_* schema tables for unauthorized changes outside maintenance windows.

Monitoring Recommendations

Ingest Oracle E-Business Suite application and database audit logs into a centralized SIEM for correlation and retention.
Enable Oracle Sign-On Audit and Page Access Tracking to capture user navigation through Subledger Accounting forms.
Alert on administrative or financial actions performed by accounts created or last modified within the previous 30 days.

How to Mitigate CVE-2026-46958

Immediate Actions Required

Apply the patches delivered in the Oracle June 2026 Critical Patch Update to all affected Oracle E-Business Suite 12.2.x instances.
Inventory all Oracle Subledger Accounting deployments running versions 12.2.3 through 12.2.15 and prioritize internet-exposed systems first.
Review and reduce the number of low-privileged accounts that hold any access to Subledger Accounting responsibilities.

Patch Information

Oracle released fixes in the June 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert for the patch identifiers applicable to their Oracle E-Business Suite 12.2 release level and apply them through the standard adop patching cycle.

Workarounds

Restrict network access to Oracle E-Business Suite HTTP endpoints using firewall rules, VPN, or reverse proxy allow-lists until patches are deployed.
Disable or lock unused Oracle Subledger Accounting responsibilities and revoke them from accounts that do not require Internal Operations access.
Enforce multi-factor authentication on all Oracle E-Business Suite user accounts to raise the cost of credential abuse needed for exploitation.

bash

# Example: identify users granted Subledger Accounting responsibilities for review
sqlplus apps/<password> <<EOF
SELECT u.user_name, r.responsibility_name, fur.start_date, fur.end_date
FROM   fnd_user u,
       fnd_user_resp_groups_direct fur,
       fnd_responsibility_tl r
WHERE  u.user_id = fur.user_id
AND    fur.responsibility_id = r.responsibility_id
AND    r.responsibility_name LIKE '%Subledger%'
ORDER  BY u.user_name;
EOF