CVE-2026-46931
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
A vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite allows low privileged attackers with network access via HTTP to compromise the system. Versions 12.2.6-12.2.15 are affected by this easily exploitable vulnerability.
Risk Assessment
An attack that could lead to the takeover of Oracle Enterprise Asset Management poses a serious threat to the integrity and availability of data within the organization.
Recommendation
It is recommended to update to the latest version of Oracle E-Business Suite to mitigate the risks associated with this vulnerability.
Other vulnerabilities in Oracle Enterprise Asset Management
See all- CVE-2026-61296High
Vulnerability in Oracle Enterprise Asset Management (component: Linear Asset Management) affects versions 12.2.3-12.2.15. A low-privileged attacker can, via HTTP and with user interaction, gain unauthorized access to critical data and modify some data, with potential impact on other products.
- CVE-2026-60760Medium
Vulnerability in Oracle Enterprise Asset Management (Oracle E-Business Suite) versions 12.2.3-12.2.15. Difficult to exploit, requires low privileges and network access via HTTP. Successful attack may lead to unauthorized update, insert, delete, or read access to some data. CVSS 4.2 (Confidentiality and Integrity impacts).
- CVE-2026-60695Medium
Vulnerability in Oracle Enterprise Asset Management (component: Internal Operations) allows a high-privileged attacker to gain unauthorized access and modify critical data. The attack is difficult, requires network access via HTTP.
- CVE-2026-60694Medium
Vulnerability in Oracle Enterprise Asset Management (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP, with user interaction, can gain unauthorized read and modify access to some data, and the attack may impact other products.
- CVE-2026-60692High
Vulnerability in Oracle Enterprise Asset Management (Internal Operations component) versions 12.2.3-12.2.15. Low-privileged attacker via HTTP can take over the system.
- CVE-2026-60588Medium
Vulnerability in Oracle Enterprise Asset Management (component: Work Definition Issues) versions 12.2.3-12.2.15. A low-privileged attacker via HTTPS can gain unauthorized read and modify access to data.
Original NVD description (English source)
Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.6-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Asset Management. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Asset Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).