CVE-2026-46972

HTTP‑Based Low‑Privilege Remote Takeover of Oracle Outsourced Mfg for Discrete Industries

Published Jun 16, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

Vulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Outsourced Mfg for Discrete Industries. Successful attacks of this vulnerability can result in takeover of Oracle Outsourced Mfg for Discrete Industries. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Analysis

Technical impact

A flaw in Oracle Outsourced Mfg for Discrete Industries allows a low‑privileged attacker with network access via HTTP to compromise the system, potentially leading to a full takeover. The vulnerability results in complete loss of confidentiality, integrity and availability and is rated CVSS 3.1 base 8.8.

Affected Systems

Oracle E‑Business Suite product Oracle Outsourced Mfg for Discrete Industries, versions 12.2.3 through 12.2.15 are affected.

Risk and Exploitability

The vulnerability is remotely exploitable over the network using standard HTTP traffic. The EPSS score of less than 1% indicates a low but present exploitation probability, and the issue is not listed in CISA’s KEV catalog. Given the high CVSS score and the low‑privilege requirement, an attacker could quickly transition to full system compromise if no mitigations are in place.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

Oracle Outsourced Mfg for Discrete Industries

affected

Version	Status	Constraints
`12.2.3`	affected	≤ 12.2.15

Configuration 1 [-]

cpe:2.3:a:oracle:outsourced_manufacturing_for_discrete_industries:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Oracle

Outsourced Mfg For Discrete Industries

Version	Status	Scheme	Platform
`[12.2.3,12.2.15]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply any available Oracle security patch for Oracle Outsourced Mfg for Discrete Industries.
Enforce least privilege and proper role‑based access controls to mitigate CWE‑269 (Improper Privilege Management).
Improve authentication mechanisms, including strong password policies and two‑factor authentication, to address CWE‑287 (Improper Authentication) and CWE‑306 (Missing Authentication for Critical Function).
Restrict network access to the Oracle Outsourced Mfg for Discrete Industries HTTP interfaces to trusted IP ranges using firewalls or ingress controls.

Generated by OpenCVE AI on June 18, 2026 at 23:36 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.301% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.oracle.com/security-alerts/cspujun2026.html

History

Jun 19, 2026 12:00 AM Title updated View changes

Type	Values Removed	Values Added
Title		HTTP‑Based Low‑Privilege Remote Takeover of Oracle Outsourced Mfg for Discrete Industries

Jun 18, 2026 10:30 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	Remote System Takeover via Low-Privilege HTTP Exploit in Oracle Outsourced Mfg for Discrete Industries
Weaknesses	CWE-284

Jun 18, 2026 4:45 AM Title updated. Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		Remote System Takeover via Low-Privilege HTTP Exploit in Oracle Outsourced Mfg for Discrete Industries
Weaknesses		CWE-269 CWE-284 CWE-287 CWE-306
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 16, 2026 8:45 PM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Outsourced Mfg for Discrete Industries. Successful attacks of this vulnerability can result in takeover of Oracle Outsourced Mfg for Discrete Industries. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared		Oracle Oracle outsourced Mfg For Discrete Industries
CPEs		cpe:2.3:a:oracle:outsourced_mfg_for_discrete_industries::::::::
Vendors & Products		Oracle Oracle outsourced Mfg For Discrete Industries
References		https://www.oracle.com/security-alerts/cspujun2026.html
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`