Brief Summary: CVE-2026-46822 Oracle iAssets Critical Takeover Vulnerability (CVSS 9.9) in E-Business Suite

Introduction

Oracle released its first monthly Critical Security Patch Update on May 28, 2026. It contains 12 security fixes for Oracle E-Business Suite, and the most severe lets a low-privileged user completely take over the Oracle iAssets module and potentially cascade into adjacent EBS components. CVE-2026-46822 carries a CVSS 3.1 base score of 9.9. Its Scope: Changed designation signals that the blast radius extends well beyond iAssets itself, into the rest of the EBS environment that enterprises rely on for financial operations, asset management, and payroll.

Oracle iAssets is a module within Oracle E-Business Suite that provides asset tracking and management, handling internal asset processing workflows for organizations running EBS. Oracle EBS is deployed across large enterprises, government agencies, and financial institutions globally, and the affected version range (12.2.3 through 12.2.15) covers virtually the entire active install base. The exposure here is substantial.

The advisory also arrives just months after the Cl0p ransomware group mass-exploited a different Oracle EBS vulnerability (CVE-2025-61882) in coordinated extortion campaigns. Oracle moved from quarterly to monthly patch cycles starting with this advisory, which is itself an acknowledgment that the threat environment around EBS has fundamentally changed.

Technical Information

CVSS Vector Breakdown

The full CVSS 3.1 vector for CVE-2026-46822 is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, which breaks down as follows:

The Scope: Changed attribute is what pushes the score from 9.8 to 9.9. It indicates that successful exploitation of Oracle iAssets can compromise the security scope of other EBS products and modules, not just iAssets itself. Financial data, asset records, payroll information, and other enterprise modules that integrate with iAssets could all be affected through a single exploitation chain.

Vulnerable Component and Attack Surface

The vulnerability resides in the Internal Operations component of Oracle iAssets, which handles internal asset processing workflows within the module. An attacker delivers the exploit through standard HTTP requests to the Oracle E-Business Suite application tier, so any network path to the EBS web interface is a viable attack vector.

The attacker needs only a low-privilege application user account, not an administrator account. Large EBS deployments can have hundreds or thousands of user accounts with basic iAssets access, and any one of them is enough to trigger the vulnerability, whether it was compromised through credential stuffing or phishing or is held by a malicious insider.

Oracle's advisory states that "successful attacks of this vulnerability can result in takeover of Oracle iAssets." That means complete compromise of the iAssets module, with full confidentiality, integrity, and availability impact.

What We Do Not Know

Several important technical details remain undisclosed as of May 29, 2026:

• The specific vulnerability type (SQL injection, SSRF, deserialization, or other) has not been publicly identified
• No CWE ID has been assigned, which limits automated vulnerability classification and mapping to known weakness patterns
• No proof-of-concept exploit code has been published
• The exact mechanism by which the Internal Operations component is exploited is not documented in public sources

For vulnerability management teams, the missing CWE classification has practical consequences. Without a formal weakness category, automated tools cannot map CVE-2026-46822 to known attack patterns, and security controls may not trigger appropriate compensating measures.

Parallels to CVE-2025-61882

CVE-2025-61882 worked through a different technical mechanism, but its exploitation shows how attackers weaponize Oracle EBS vulnerabilities. Attackers exploited that flaw, in Oracle EBS Concurrent Processing (BI Publisher Integration), through server-side request forgery (SSRF). Specially crafted HTTP requests forced vulnerable systems to download and execute attacker-controlled code, which gave the attacker full control of the EBS host. Cl0p took a "living off the land" approach, using native system utilities and simple shell commands that looked like routine Java process operations. That made detection difficult.

CVE-2026-46822 targets a different component, but the same HTTP-based attack surface and EBS architecture make analogous exploitation patterns plausible. Oracle source code also leaked publicly during the CVE-2025-61882 incident, which may give threat actors a deeper understanding of EBS internals and make similar vulnerabilities easier to find and exploit.

Affected Systems and Versions

The vulnerability affects the following:

• Product: Oracle iAssets
• Component: Internal Operations
• Platform: Oracle E-Business Suite
• Affected Versions: 12.2.3 through 12.2.15

This version range covers virtually the entire deployed base of Oracle EBS 12.2 customers. Oracle E-Business Suite 12.2 remains under extended Premier Support, so all versions in this range are expected to receive security patches.

Other EBS Vulnerabilities in the May 2026 CSPU

CVE-2026-46822 is the highest-scored of 12 Oracle EBS vulnerabilities addressed in the May 2026 CSPU. The full list:

Three of these 12 vulnerabilities are remotely exploitable without authentication. At 9.9, CVE-2026-46822 should be the highest priority in this batch.

Vendor Security History

Oracle E-Business Suite has had a concerning run of critical security events over the past year:

The CVE-2025-61882 incident is the most relevant precedent. Oracle issued an emergency out-of-band Security Alert for a vulnerability in the Concurrent Processing component affecting EBS versions 12.2.3 through 12.2.14. The Cl0p ransomware group exploited the flaw in mass data theft and extortion campaigns. Bitsight observed growing chatter about the vulnerability in cybercriminal forums, a sign of broad criminal interest in Oracle EBS as a target class. Oracle also separately confirmed a data breach that occurred through outdated, unpatched servers.

The move from quarterly CPUs to monthly CSPUs, beginning with the advisory that addresses CVE-2026-46822, is Oracle's structural response to this pattern. The new cadence brings its own problem. Organizations used to quarterly patch testing cycles must now adapt to monthly windows, and patch fatigue could delay patching during the early window when exploitation is most likely.

Threat Intelligence Context

As of May 29, 2026, there is no confirmed evidence of active exploitation of CVE-2026-46822, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog. Only about 24 hours have passed since disclosure, though, so this assessment carries high uncertainty.

Several factors make future exploitation more likely:

1. Proven target class: The Cl0p campaign against CVE-2025-61882 demonstrated that ERP data is valuable for extortion, and cybercriminal forums showed broad interest in Oracle EBS vulnerabilities
2. High visibility: A 9.9 CVSS score makes this vulnerability highly visible in automated scanning and threat intelligence feeds
3. Low exploitation barrier: Network access, low complexity, low privileges, no user interaction
4. Leaked source code: Public disclosure of Oracle source code from the CVE-2025-61882 incident may give threat actors a deeper understanding of EBS architecture
5. Shrinking exploitation windows: VulnCheck's 2026 exploitation analysis reports that 28.96% of KEVs identified in 2025 were exploited on or before the day their CVE was published

During the CVE-2025-61882 campaign, Cl0p used living-off-the-land techniques (native system utilities rather than custom malware), stole and extorted data rather than deploying encryption-based ransomware, and ran mass exploitation campaigns against multiple organizations simultaneously. The group has a well-established history of targeting zero-days in enterprise applications, including MOVEit Transfer, GoAnywhere MFT, and SolarWinds Serv-U.

CVE-2026-46822 requires a low-privilege authenticated account, while CVE-2025-61882 required no authentication at all. The authentication requirement raises the bar slightly, but it does not meaningfully reduce risk in environments where EBS user accounts are numerous, shared, or protected by weak credential policies. Cl0p has shown it can obtain initial access through credential harvesting, phishing, or buying stolen credentials, any of which would bridge the privilege gap.

Mitigation Guidance

Oracle has released a patch for CVE-2026-46822 as part of the May 2026 Critical Security Patch Update. The advisory's "Patch Availability Document" column provides patch availability and installation instructions, accessible through My Oracle Support (document ID CPU155).

For organizations that cannot apply the patch immediately, Oracle suggests two interim workarounds:

1. Block network protocols required by the attack: Restrict or filter HTTP access to the Oracle iAssets component to reduce the attack surface
2. Remove unnecessary privileges from users: Reduce the number of user accounts with any level of iAssets access to limit potential attack vectors

Oracle explicitly warns that neither workaround corrects the underlying problem and that both may break application functionality. Treat them as temporary measures only.

Additional defense-in-depth recommendations, drawn from lessons of the CVE-2025-61882 response:

• Ensure Oracle EBS instances are not unnecessarily exposed to the internet, and limit access through VPNs and network segmentation
• Implement enhanced security monitoring for suspicious HTTP traffic targeting EBS application modules
• Review access controls and minimize the number of accounts with any iAssets access privileges
• Assess the exposure of third-party vendors running Oracle EBS to prevent supply chain compromise
• Prepare incident response teams for Oracle-targeted attacks, given the precedent of active exploitation

References

• NVD: CVE-2026-46822
• Oracle Security Critical Patch Update Advisory, May 2026
• Oracle Security Alerts Portal
• Oracle E-Business Suite Applications
• Oracle iAssets User Guide Release 12.2 (PDF)
• Oracle Security Alert: CVE-2025-61882
• Oligo Security: CVE-2025-61882 Oracle EBS Zero Day Exploited in Cl0p Extortion Campaigns
• Bitsight: Critical Vulnerability Alert CVE-2025-61882 in Oracle E-Business Suite
• SecurityWeek: Oracle E-Business Suite Zero Day Exploited in Cl0p Attacks
• SecurityWeek: CISA Confirms Exploitation of Latest Oracle EBS Vulnerability
• Quorum Cyber: Exploitation of Critical Vulnerability in Oracle E-Business Suite
• HIPAA Journal: Cl0p Mass Exploiting Zero Day Vulnerability in Oracle E-Business Suite
• CISA Known Exploited Vulnerabilities Catalog
• VulnCheck: State of Exploitation 2026
• Oracle EBS Tech Blog: Upgrade Reminder and Monthly CSPU Announcement