CVE-2026-46956

High-Privilege HTTP Access Enables Complete Compromise of Oracle Property Manager

Published Jun 16, 2026 CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Description

Vulnerability in the Oracle Property Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Property Manager. Successful attacks of this vulnerability can result in takeover of Oracle Property Manager. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Analysis

Technical impact

A flaw in Oracle Property Manager allows an attacker who already possesses high‑privilege credentials and network access via HTTP to take complete control of the application. The vulnerability can be exploited with low effort, and successfully compromising the system results in the loss of confidentiality, integrity, and availability of the application and the data it manages. The weakness is indexed by the well‑known CWE classes for privilege enforcement issues.

Affected Systems

Oracle Property Manager from Oracle Corporation is affected. All supported versions from 12.2.3 to 12.2.15 are susceptible.

Risk and Exploitability

With a CVSS base score of 7.2, this flaw carries a substantial impact. The EPSS score of 0–1% indicates low overall exploitation probability, yet the attack is straightforward once the attacker has high‑privilege network access. The vulnerability is not listed in the CISA KEV catalog, so no public exploits are confirmed. Attackers would access the application over HTTP, leverage the privilege escalation flaw, and gain full control of the system.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

Oracle Property Manager

affected

Version	Status	Constraints
`12.2.3`	affected	≤ 12.2.15

Configuration 1 [-]

cpe:2.3:a:oracle:property_manager:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Oracle

Property Manager

Version	Status	Scheme	Platform
`[12.2.3,12.2.15]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the vendor’s security patch released for Oracle Property Manager versions 12.2.3 through 12.2.15.
Restrict HTTP access to trusted networks or apply firewall rules to limit exposure to the application.
Reduce user privilege levels within Oracle Property Manager to the minimum required for each role.

Generated by OpenCVE AI on June 18, 2026 at 23:54 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.453% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.oracle.com/security-alerts/cspujun2026.html

History

Jun 19, 2026 12:15 AM Title updated View changes

Type	Values Removed	Values Added
Title		High-Privilege HTTP Access Enables Complete Compromise of Oracle Property Manager

Jun 18, 2026 10:00 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	High Privilege Escalation Vulnerability in Oracle Property Manager Enables Full System Compromise
Weaknesses	CWE-285 CWE-798

Jun 18, 2026 4:45 AM Title updated. Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		High Privilege Escalation Vulnerability in Oracle Property Manager Enables Full System Compromise
Weaknesses		CWE-284 CWE-285 CWE-798
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 16, 2026 8:45 PM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the Oracle Property Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Property Manager. Successful attacks of this vulnerability can result in takeover of Oracle Property Manager. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
First Time appeared		Oracle Oracle property Manager
CPEs		cpe:2.3:a:oracle:property_manager::::::::
Vendors & Products		Oracle Oracle property Manager
References		https://www.oracle.com/security-alerts/cspujun2026.html
Metrics		cvssV3_1 `{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}`