# CVE-2026-46915: Oracle E-Business Suite improper access control in CMRO Production

Source: https://junglewise.ai/threats/cve-2026-46915-oracle-e-business-suite-improper-access-control-in-cmro  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-06-17  
License: CC BY 4.0 with a link back

CVE-2026-46915 · Severity: high · CVSS 8.5 · Published 2026-06-17

A vulnerability exists in the Production component of Oracle's Complex Maintenance, Repair and Overhaul (CMRO) software, which is used by organizations to manage heavy equipment maintenance and engineering. A low-privileged user could exploit this flaw to take full control of the system, potentially leading to the theft of sensitive maintenance data or disruption of critical repair operations. Because this component is integrated with the broader Oracle E-Business Suite, an attack could also impact other connected business systems.

Technologies: [Oracle Complex Maintenance, Repair and Overhaul](https://junglewise.ai/threats/technologies/complex-maintenance-repair-and-overhaul). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2026-46915 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46915 being exploited in the wild.

**How severe is CVE-2026-46915?** High severity, with a CVSS score of 8.5, published 17 June 2026.

**Which products and versions are affected?** Oracle Complex Maintenance, Repair and Overhaul 12.2.3-12.2.15.

**Is there a fix for CVE-2026-46915?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-46915 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-46915?** Check whether you run Oracle Complex Maintenance or Repair and Overhaul at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is classified as an improper access control issue (CWE-284) within the Production component of Oracle Complex Maintenance, Repair and Overhaul. It is exploitable by a low-privileged attacker with network access via HTTP, though Oracle notes the exploit complexity is high. A successful exploit results in a 'scope change' (SSVC technical impact: total), meaning the attacker can move beyond the CMRO component to impact other parts of the Oracle E-Business Suite environment. The vulnerability allows for a complete takeover of the affected product, impacting confidentiality, integrity, and availability. Affected versions include 12.2.3 through 12.2.15.

## Affected products

- Oracle Complex Maintenance, Repair and Overhaul 12.2.3-12.2.15

## Timeline

- 2026-06-17: disclosed
- 2026-06-17: advisory

## References

- [https://www.oracle.com/security-alerts/cspujun2026.html](https://www.oracle.com/security-alerts/cspujun2026.html)

## Related threats

- [Oracle E-Business Suite data compromise in Complex Maintenance, Repair and Overhaul](https://junglewise.ai/threats/cve-2026-60771-oracle-e-business-suite-data-compromise-in-complex-maintenance)
- [Oracle E-Business Suite data manipulation in Complex Maintenance, Repair and Overhaul](https://junglewise.ai/threats/cve-2026-60717-oracle-e-business-suite-data-manipulation-in-complex-maintenance)
- [Oracle E-Business Suite privilege escalation in Complex Maintenance Repair and Overhaul](https://junglewise.ai/threats/cve-2026-46935-oracle-e-business-suite-privilege-escalation-in-complex)
- [Oracle E-Business Suite improper access control in Internal Operations](https://junglewise.ai/threats/cve-2026-46934-oracle-e-business-suite-improper-access-control-in-internal)