CVE-2026-46952

Low-Privilege Remote HTTP Attack Enables System Takeover in Oracle Quality

Published Jun 16, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Quality. Successful attacks of this vulnerability can result in takeover of Oracle Quality. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Analysis

Technical impact

The Oracle Quality component of Oracle E‑Business Suite contains a weakness that permits a low‑privileged user with network access to the HTTP interface to obtain full control of the system. The flaw is a privilege escalation issue (CWE‑269) compounded by insufficient authentication, authorization and session management (CWE‑287 and CWE‑306), allowing the attacker to bypass security. Successful exploitation can compromise confidentiality, integrity and availability, resulting in a complete takeover of Oracle Quality.

Affected Systems

Affected versions range from 12.2.3 through 12.2.15 of Oracle Quality. The product resides within the Internal Operations component of Oracle E‑Business Suite and is deployed by organizations that manage Oracle Quality processes.

Risk and Exploitability

The CVSS 8.8 vector indicates a high‑severity, network‑based attack that requires low effort and low‑privileged attacker. The EPSS score of less than 1% suggests exploitation is currently unlikely, but the vulnerability is not listed in the CISA KEV catalog. Because the flaw is remotely exploitable over HTTP without local privileges, any machine hosting Oracle Quality that is reachable from outside the trusted network faces a serious risk of compromise.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

Oracle Quality

affected

Version	Status	Constraints
`12.2.3`	affected	≤ 12.2.15

Configuration 1 [-]

cpe:2.3:a:oracle:quality:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Oracle

Quality

Version	Status	Scheme	Platform
`[12.2.3,12.2.15]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the available Oracle patch for Oracle Quality to address the remote takeover vulnerability.
If the patch cannot be applied immediately, isolate Oracle Quality by restricting HTTP access to trusted internal networks using firewall rules or VPN, ensuring only authorized systems can reach the service.
Strengthen access controls by disabling or limiting low‑privileged accounts from performing administrative functions on Oracle Quality and ensure the system’s authentication and authorization configurations are reviewed to prevent unauthorized use.

Generated by OpenCVE AI on June 18, 2026 at 23:22 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.402% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.oracle.com/security-alerts/cspujun2026.html

History

Jun 18, 2026 11:45 PM Title updated View changes

Type	Values Removed	Values Added
Title		Low-Privilege Remote HTTP Attack Enables System Takeover in Oracle Quality

Jun 18, 2026 10:45 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	Oracle Quality Vulnerability Allows Remote Takeover via HTTP
Weaknesses	CWE-284

Jun 18, 2026 4:45 AM Title updated. Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		Oracle Quality Vulnerability Allows Remote Takeover via HTTP
Weaknesses		CWE-269 CWE-284 CWE-287 CWE-306
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 16, 2026 8:45 PM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Quality. Successful attacks of this vulnerability can result in takeover of Oracle Quality. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared		Oracle Oracle quality
CPEs		cpe:2.3:a:oracle:quality::::::::
Vendors & Products		Oracle Oracle quality
References		https://www.oracle.com/security-alerts/cspujun2026.html
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`