PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46821 Oracle Corporation CVE debrief

A high-severity confidentiality vulnerability in Oracle E-Business Suite Financials Common Modules allows low-privileged attackers with network access to gain unauthorized access to critical data across multiple products. The vulnerability affects versions 12.2.3 through 12.2.15 and was disclosed by Oracle in May 2026.

Vendor
Oracle Corporation
Product
Oracle Financials Common Modules
CVSS
HIGH 7.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-29
Advisory published
2026-05-28
Advisory updated
2026-05-29

Who should care

Organizations running Oracle E-Business Suite versions 12.2.3-12.2.15 with Financials Common Modules deployed, particularly those with integrated product environments where scope change could expand data exposure risk.

Technical summary

The vulnerability exists in Oracle Financials Common Modules (component: Common Components) and allows low-privileged attackers with network access via HTTP to compromise confidentiality of critical data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, changed scope affecting additional products, and high confidentiality impact with no integrity or availability impact.

Defensive priority

HIGH

Recommended defensive actions

  • Apply Oracle Critical Patch Update for May 2026 to affected E-Business Suite installations
  • Restrict network access to Oracle Financials Common Modules to authorized users only
  • Review access logs for unauthorized data access attempts by low-privileged accounts
  • Assess scope of accessible data across integrated Oracle products given S:C scope change
  • Validate patch deployment across all affected versions (12.2.3-12.2.15)
  • Monitor Oracle security alerts for additional guidance on this vulnerability

Evidence notes

Oracle's official security advisory confirms affected versions (12.2.3-12.2.15) and CVSS 3.1 scoring. NVD entry reflects identical technical details with vulnStatus 'Received'. No CISA KEV listing present.

Official resources

Oracle disclosed this vulnerability on 2026-05-28 as part of its Critical Patch Update. The vulnerability resides in the Common Components module of Oracle Financials Common Modules but can impact additional products through scope change.