CVE-2026-46956: Oracle Property Manager Privilege Escalation Vulnerability (CVSS 7.2)

Technical summary

This vulnerability exists in Oracle Property Manager versions 12.2.3 through 12.2.15 and is classified under CWE-284 (Improper Access Control). The attack requires HTTP network access and high privilege credentials, but no user interaction is required. The flaw allows authenticated administrative users to bypass intended access restrictions and achieve full system compromise. CVSS 3.1 score of 7.2 reflects the severity: while exploitation demands elevated privileges, successful attacks result in complete confidentiality, integrity, and availability impacts across the affected component.

Business impact

Compromise of Oracle Property Manager can expose sensitive property management data, including lease agreements, tenant information, facility inventories, and financial records. An attacker could alter maintenance schedules, redirect service vendor payments, modify lease terms, or deny access to facility management functions. For organizations using Property Manager for critical real estate operations, this creates operational disruption risk, regulatory compliance exposure (particularly if tenant or financial data is altered), and potential reputational harm if property operations are visibly degraded.

Affected systems

Oracle Property Manager in E-Business Suite versions 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, 12.2.8, 12.2.9, 12.2.10, 12.2.11, 12.2.12, 12.2.13, 12.2.14, and 12.2.15 are vulnerable. Organizations running Oracle EBS must verify whether Property Manager is deployed and which versions are in use. This vulnerability does not affect earlier 12.2 versions (pre-12.2.3) or later versions beyond 12.2.15.

Exploitability

Exploitation requires high-privilege (administrative) credentials and network access to the HTTP interface hosting Property Manager. The vulnerability is 'easily exploitable' given those preconditions—no complex manipulation or user interaction is needed once authenticated access is established. However, the prerequisite of high privileges significantly limits the attacker pool to insiders, compromised admin accounts, or attackers who have already breached initial access controls. The risk is highest in environments with weak credential hygiene or excessive privilege delegation.

Remediation

Verify your Oracle EBS deployment includes Property Manager and confirm the specific version. Contact Oracle Support or consult the Oracle Critical Patch Update (CPU) schedule for available patches. Patches are released as part of quarterly CPU bundles; apply the patch appropriate to your version, which will be documented in the Oracle security bulletin published alongside the CVE. If patching is delayed, implement strict access controls limiting administrative access to Property Manager to named, audited personnel, and enable detailed logging of all administrative actions.

Patch guidance

Oracle addresses this vulnerability through its quarterly Critical Patch Update (CPU) process. Verify the exact patch version applicable to your Property Manager version (12.2.3–12.2.15) in the official Oracle security advisory. Test patches in a non-production environment before deployment to ensure compatibility with custom extensions and dependent modules. Patching should be coordinated with your EBS maintenance windows to minimize disruption. Document the patch level and deployment date for audit purposes.

Detection guidance

Monitor HTTP traffic to Property Manager endpoints for administrative users performing unusual operations, particularly those modifying access controls, financial records, or system configurations. Enable and review detailed Property Manager audit logs focusing on privilege escalation events and bulk data modification operations. Use your SIEM to correlate admin logins to Property Manager with subsequent abnormal application behavior. Network-based detection should flag suspicious authentication patterns or administrative activity from unexpected source IPs. Consider baseline-building for normal admin activity to improve anomaly detection.

Why prioritize this

Although this vulnerability requires high-privilege credentials, it warrants urgent attention because successful exploitation grants complete application takeover. Organizations with weaker identity governance, shared admin accounts, or elevated privilege access risks should prioritize remediation. The data exposure potential (property, lease, and financial records) adds compliance implications. Prioritize patching if your environment has experienced any identity compromise, if admin passwords are infrequently rotated, or if Property Manager manages mission-critical real estate operations.

Risk score, explained

CVSS 3.1 score of 7.2 (HIGH) reflects the complete confidentiality, integrity, and availability impact possible after exploitation, combined with low attack complexity and no user interaction requirement. The score is tempered by the requirement for high-privilege credentials—a significant limiting factor. Organizations with robust privilege access management and strong identity controls will face lower practical risk; those with permissive admin access face substantially higher risk and should treat this as critical.

Frequently asked questions