CVE-2026-83446

An easily exploitable authorization flaw in the Common Components of Oracle Financials Common Modules, part of Oracle E-Business Suite, allows a low-privileged attacker with network access via HTTP to compromise the product. Successful attacks can result in unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to all data accessible through Oracle Financials Common Modules. The vulnerability (CVSS 3.1 base score 8.1) affects supported versions 12.2.3 through 12.2.15 and requires only a low-privileged account, so any authenticated user of an exposed EBS instance is a potential attack vector. Availability is not impacted (C:H/I:H/A:N). There is no evidence of in-the-wild exploitation and no public proof of concept is known.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-83446 to all Oracle E-Business Suite 12.2.3-12.2.15 environments running Financials Common Modules. Restrict HTTP access to EBS self-service and module pages to VPN or trusted networks so low-privileged accounts cannot reach the vulnerable component from the open internet. Review EBS audit trails and account privileges for unexpected data creation, modification, or deletion in Financials Common Modules, and enforce least-privilege roles for users who need HTTP access.