CVE-2026-46819
CVE-2026-46819 is a critical vulnerability in Oracle Internet Procurement Connector that allows unauthenticated attackers to access or modify sensitive data via HTTP. It affects Oracle E-Business Suite versions 12.2.3 to 12.2.15 and carries a CVSS score of 9.1 due to high confidentiality and integrity impacts.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Oracle E-Business Suite users running versions 12.2.3 to 12.2.15 of the Oracle Internet Procurement Connector component.
Real-world impact
Unauthenticated attackers with network access can exploit this vulnerability to gain unauthorized access to or modify critical data stored or processed by the Oracle Internet Procurement Connector.
Why this severity
CVSS 9.1 (Critical): High risk of data breaches or manipulation due to ease of exploitation via HTTP without authentication.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
NVD vulnerability description
Timeline
- May 28, 2026 · May 28, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 14d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- oracle.com/security-alerts/cspumay2026…vendor advisory