PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46967 Oracle Corporation CVE debrief

A high-severity vulnerability was found in Oracle Public Sector Financials (International), affecting versions 12.2.3-12.2.15. This easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to compromise the system, potentially leading to a takeover. The vulnerability is located in the Authorization component and has a CVSS 3.1 Base Score of 8.8, indicating high impacts on Confidentiality, Integrity, and Availability. Organizations should prioritize patching this vulnerability to prevent potential system compromise.

Vendor
Oracle Corporation
Product
Oracle Public Sector Financials (International)
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-06-18
Advisory published
2026-06-17
Advisory updated
2026-06-18

Who should care

Organizations using Oracle Public Sector Financials (International) versions 12.2.3-12.2.15 should prioritize patching this vulnerability to prevent potential system compromise. Security teams and vulnerability management teams should review the affected scope and implement compensating controls for exposed systems while remediation is scheduled and verified.

Technical summary

The vulnerability is located in the Authorization component of Oracle Public Sector Financials (International). It has a CVSS 3.1 Base Score of 8.8, indicating high impacts on Confidentiality, Integrity, and Availability. The CVSS Vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability allows a low-privileged attacker with network access via HTTP to compromise the system. Successful attacks can result in takeover of Oracle Public Sector Financials (International).

Defensive priority

High priority should be given to patching this vulnerability due to its high CVSS score and the potential for system takeover.

Recommended defensive actions

  • Apply the patch provided by Oracle Corporation as soon as possible.
  • Conduct a thorough inventory check to identify all instances of Oracle Public Sector Financials (International) versions 12.2.3-12.2.15.
  • Implement compensating controls such as network segmentation or access restrictions to limit the attack surface.
  • Monitor system logs for suspicious activity.
  • Consider exception tracking for systems that cannot be patched immediately.
  • Review relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-06-17T10:54:15.873Z and was last modified on 2026-06-18T21:08:09.153Z. The NVD entry is currently Analyzed. This information is based on the NVD entry and the CVE record. The vulnerability affects Oracle Public Sector Financials (International) versions 12.2.3-12.2.15. Evidence of exploitation is not currently available, but defenders should verify system logs for suspicious activity related to the vulnerability.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-06-17T10:54:15.873Z and has not been modified since then. The NVD entry is currently Analyzed.