CVE-2026-46837
Oracle Flow Manufacturing SQL Injection Vulnerability
Publication date: 2026-05-28
Last updated on: 2026-05-29
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | flow_manufacturing | From 12.2.9 (inc) to 12.2.15 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Oracle Flow Manufacturing product of the Oracle E-Business Suite, specifically in its security component. It affects supported versions 12.2.9 through 12.2.15. The vulnerability is easily exploitable by a low privileged attacker who has network access and can execute SQL commands. Exploiting this vulnerability allows the attacker to compromise the Oracle Flow Manufacturing system.
How can this vulnerability impact me? :
Successful exploitation of this vulnerability can lead to a complete takeover of the Oracle Flow Manufacturing system. The impact includes high severity effects on confidentiality, integrity, and availability of the system, meaning sensitive data could be exposed or altered, and system operations could be disrupted.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows a low privileged attacker with network access to compromise Oracle Flow Manufacturing, potentially leading to a complete takeover of the system. Given the high impact on confidentiality, integrity, and availability (CVSS 3.1 Base Score 8.8), exploitation could result in unauthorized access to sensitive data, data manipulation, or service disruption.
Such impacts could negatively affect compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive data and system integrity. A successful attack could lead to data breaches or loss of data integrity, thereby violating these regulatory requirements.