CVE-2026-46933: oracle corporation oracle applications manager Improper Privilege Management

Vulnerability summary

CVE-2026-46933 is a critical (CVSS 9.9) Improper Privilege Management vulnerability in oracle corporation oracle applications manager. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36.3% of scored vulnerabilities.

Timeline

1. 16-06-2026
   PublishedVulnerability first disclosed.
2. 18-06-2026
   Last modifiedVulnerability information updated.

Description

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager. While the vulnerability is in Oracle Applications Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.