Brief Summary: CVE-2026-46819 — Unauthenticated Data Access in Oracle E-Business Suite Internet Procurement Connector

Introduction

Oracle's inaugural monthly Critical Security Patch Update for May 2026 includes a fix for a CVSS 9.1 vulnerability in the Internet Procurement Connector. The flaw lets an unauthenticated attacker read and manipulate critical procurement data over HTTP. Last year the GRACEFUL SPIDER threat group (operating as Cl0p) carried out mass exploitation of a structurally similar Oracle EBS flaw, so a playbook for attacking EBS procurement infrastructure already exists.

Oracle Internet Procurement Connector is part of the Oracle Procurement suite within E-Business Suite. Organizations use it to manage procurement workflows, including requisition processing, purchase order management, and supplier interactions. The Internal Operations component, which this vulnerability targets, handles back-end processing logic for procurement data flows. It processes sensitive financial and supplier data, which makes it a high-value target.

Technical Information

Vulnerability Profile

CVE-2026-46819 affects the Internal Operations component of the Oracle Internet Procurement Connector product within Oracle E-Business Suite, in versions 12.2.3 through 12.2.15. That range covers every currently supported EBS 12.2 release, so no supported EBS 12.2 deployment is exempt.

The CVSS 3.1 Base Score of 9.1, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, breaks down as follows:

The attack protocol is HTTP, so exploitation happens through standard web requests to the Oracle E-Business Suite application tier. Oracle's advisory calls the vulnerability "easily exploitable," which corresponds to the low attack complexity rating in CVSS terms.

Impact Analysis

The C:H/I:H/A:N impact profile separates this vulnerability from the previously exploited CVE-2025-61882, which carried A:H and enabled remote code execution. The absence of availability impact suggests that CVE-2026-46819 enables direct data access and tampering through the application layer rather than arbitrary code execution. Successful exploitation results in:

• Unauthorized access to critical data or complete access to all Oracle Internet Procurement Connector accessible data
• Unauthorized creation, deletion, or modification of critical data

An attacker could read, alter, or delete procurement records, supplier information, purchase orders, and related financial data. Manipulated procurement data could cascade into supply chain fraud, financial misstatement, or regulatory non-compliance.

Attack Surface Comparison with CVE-2025-61882

No public proof of concept or detailed technical mechanism has been published for CVE-2026-46819, but its exploitation pattern is strongly analogous to that of CVE-2025-61882. Both vulnerabilities have the same attack prerequisites: unauthenticated, network-accessible, HTTP-based, low complexity, and no user interaction.

CrowdStrike documented three stages in the CVE-2025-61882 attack chain:

1. An HTTP POST request to /OA_HTML/SyncServlet to bypass authentication
2. Upload of a malicious XSLT template via requests to /OA_HTML/RF.jsp and /OA_HTML/OA.jsp to achieve code execution
3. Deployment of web shells (using FileUtils.java and Log4jConfigQpgsubFilter.java) for persistence, with outbound connections established over port 443

CVE-2026-46819 targets a different component (Internal Operations rather than Concurrent Processing) and results in data manipulation rather than code execution. Even so, the shared HTTP vector and lack of authentication suggest a similar class of EBS application-tier vulnerability, likely involving insufficient access controls on procurement-related servlet endpoints.

Information Gaps

Several technical details remain unavailable as of May 29, 2026:

• CWE classification: NVD has not assigned any CWE IDs
• Specific exploitation steps: The exact HTTP request pattern, vulnerable endpoint, or code-level flaw within the Internal Operations component has not been publicly documented
• CVSS 4.0 score: NIST has not yet provided one
• Public exploit code: No proof of concept has been identified

The NVD record's status is "Received," which indicates very recent publication and incomplete enrichment.

Patch Information

Oracle fixed CVE-2026-46819 in its inaugural Critical Security Patch Update (CSPU) for May 2026, released on May 28, 2026. It is the very first release under Oracle's new monthly CSPU cadence, a program that supplements the traditional quarterly Critical Patch Updates with smaller, more focused security releases each month.

The fix for CVE-2026-46819 is one of 12 security patches for Oracle E-Business Suite in this CSPU. It targets the Internal Operations component of the Oracle Internet Procurement Connector product, in versions 12.2.3 through 12.2.15. In the risk matrix in Oracle's verbose advisory, the entry for CVE-2026-46819 does not mention fixes for any other CVEs, which means this is a standalone, targeted fix for this specific flaw. Several other CVEs in the same CSPU are different: for CVE-2026-34059 or CVE-2025-15467, for example, Oracle explicitly notes that the patch also addresses multiple companion CVEs.

Oracle E-Business Suite is proprietary, closed-source software, so no public source code diffs or commit-level details are available. Customers with active Oracle support contracts can get the patch through My Oracle Support (MOS) by referencing the May 2026 CSPU advisory. Oracle's patch availability document for E-Business Suite Release 12 (typically available via MOS Note KA923) specifies the exact patch numbers and application steps for each affected EBS module.

The CSPU model is designed specifically for customer-managed environments, either on-premises or customer-managed OCI. Oracle-managed cloud services receive these security updates automatically and continuously. Customer-managed deployments should apply this patch urgently, given the CVSS 9.1 score and the unauthenticated HTTP attack vector.

Oracle's advisory also stresses that E-Business Suite products include Oracle Database and Oracle Fusion Middleware components, and that customers must apply the May 2026 CSPU to those underlying components as well. Patching only the EBS application layer, without the database and middleware tiers, may leave residual exposure.

For organizations adapting to the monthly cadence, Oracle provides the EBS Java Critical Patch Update Checker (EJCPUC) tool, updated in April 2026, to help administrators find missing patches across their EBS environments. Oracle also recommends upgrading to EBS Release 12.2 and modernizing database infrastructure to Oracle AI DB 26ai or DB 19c to stay eligible for security fixes.

Affected Systems and Versions

• Product: Oracle Internet Procurement Connector
• Suite: Oracle E-Business Suite
• Component: Internal Operations
• Affected Versions: 12.2.3 through 12.2.15 (all currently supported EBS 12.2 releases)
• Protocol: HTTP
• Authentication Required: None

Oracle does not test product releases outside Premier Support or Extended Support for vulnerabilities, so older unsupported versions may also be affected but will not receive patches.

Vendor Security History

Oracle E-Business Suite has a persistent pattern of critical, remotely exploitable vulnerabilities. The following table summarizes recent high-severity EBS CVEs:

The October 2025 CPU contained 9 new security patches for Oracle E-Business Suite, 6 of which were remotely exploitable without authentication. The May 2026 CSPU contains 12 new EBS patches, 3 of them remotely exploitable without authentication. Across both releases, EBS shows a persistent and significant attack surface.

CrowdStrike assessed with moderate confidence that GRACEFUL SPIDER was involved in mass exploitation of CVE-2025-61882. Operating under the "CLOP team" moniker, the threat actor used known email addresses (support[@]pubstorm[.]com and support[@]pubstorm[.]net) to send extortion emails to victims on September 29, 2025, claiming to have accessed and exfiltrated data from their Oracle EBS applications. Exploitation had begun nearly two months earlier, on August 9, 2025, well before Oracle's public disclosure on October 4, 2025. A Telegram channel post on October 3, 2025 insinuated collaboration between SCATTERED SPIDER, SLIPPY SPIDER, and ShinyHunters, and contained a purported exploit for the vulnerability. Google Cloud/Mandiant separately confirmed Cl0p ransomware gang involvement in a large-scale extortion campaign.

Oracle's own advisory acknowledges the problem directly. The company "continues to receive reports of attempted malicious exploitation of vulnerabilities for which patches have already been released" and notes that "attackers have been successful because targeted customers failed to apply available patches."

The move from quarterly CPUs to monthly CSPUs, effective May 2026, was driven in part by AI-accelerated vulnerability discovery and by the operational lessons of the CVE-2025-61882 zero-day campaign. Oracle stated that AI "has significantly accelerated the pace at which software vulnerabilities are discovered, increasing the urgency for rapid response and remediation."

Threat Assessment for CVE-2026-46819

As of May 29, 2026, CVE-2026-46819 is not listed in the CISA Known Exploited Vulnerabilities catalog, and no confirmed exploitation has been observed. Several factors still point to elevated risk:

1. Precedent: GRACEFUL SPIDER has already shown the capability and intent to exploit unauthenticated HTTP-based Oracle EBS vulnerabilities with a mass scan-and-exploit model
2. Attack surface similarity: CVE-2026-46819 has the same unauthenticated HTTP attack vector and EBS application-tier target as CVE-2025-61882
3. Rapid exploitation window: The CVE-2025-61882 timeline shows that exploitation can begin months before public disclosure, and the gap between disclosure and public PoC availability was only one day
4. Patch gap risk: Oracle has acknowledged that attackers succeed because customers fail to apply available patches

Organizations should not wait for a CISA KEV listing or confirmed exploitation reports before applying this patch.

References

• NVD: CVE-2026-46819
• Oracle Security Critical Patch Update Advisory: May 2026
• Oracle Security Critical Patch Update Advisory: May 2026 (Verbose)
• CrowdStrike: Campaign Targeting Oracle E-Business Suite Zero-Day CVE-2025-61882
• Oracle: Monthly Critical Security Patch Updates Announcement
• Oracle Critical Patch Update Advisory: October 2025
• Rapid7: Critical 0day in Oracle E-Business Suite Exploited in the Wild
• Google Cloud/Mandiant: Oracle E-Business Suite Zero-Day Exploitation
• CISA Known Exploited Vulnerabilities Catalog
• CISA: Adds Three Known Exploited Vulnerabilities to Catalog (May 27, 2026)
• Oracle: April 2026 Updates to EBS Java Critical Patch Update Checker
• Oracle iProcurement Overview
• Oracle E-Business Suite Applications
• Oracle: Reminder to Upgrade to Oracle AI DB 26ai or DB 19c
• CSA Singapore: Critical Vulnerability in Oracle Products