CVE-2026-46822

CriticalCVSS 9.9

Published: 28/05/2026(UTC)Updated: 21/07/2026(UTC)Translated: 22/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

Critical vulnerability in Oracle iAssets (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can take over the system, potentially affecting other products.

Risk Assessment

Risk of full compromise of Oracle iAssets and potential impact on other systems, leading to loss of confidentiality, integrity, and availability.

Recommendation

Apply the Oracle patch immediately for versions 12.2.3-12.2.15. Restrict network access to the Oracle iAssets HTTP interface to trusted users only.

Original NVD description (English source)

Vulnerability in the Oracle iAssets product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iAssets. While the vulnerability is in Oracle iAssets, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle iAssets. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).