CVE-2026-46820: Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Common Components)

Synopsis

An unspecified vulnerability (likely improper access control or data exposure) affects the Common Components module of Oracle Financials Common Modules within Oracle E-Business Suite versions 12.2.3 through 12.2.15. The flaw is reachable over the network via HTTP and requires only a low-privileged account, with no user interaction needed; the CVSS scope change indicator means a successful attack can spill beyond the directly targeted component. Exploitation gives an attacker full read access to all data handled by Oracle Financials Common Modules and limited write access to insert, update, or delete some of that data. No fix version has been published by Oracle; HarborGuard is tracking this advisory and will surface a patched-image rebuild the moment an upstream fix becomes available.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle E-Business Suite HTTP endpoint over a network connection; the service must be exposed to the attacker's network segment.

• AuthenticationRequired

  A valid low-privilege account is sufficient; no administrative or elevated rights are needed to trigger the vulnerability.

• Victim interactionNot required

  No action from any other user or administrator is needed; the attacker can exploit the flaw entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and repeatable with no dependency on race conditions, special memory layouts, or other variable environmental factors.

Blast Radius

• Reads all data accessible to Oracle Financials Common Modules, which can include financial records, transaction histories, and sensitive configuration data.
• Inserts, updates, or deletes a subset of that data, allowing an attacker to tamper with financial records or corrupt application state.
• The CVSS scope change means impact can extend beyond the directly compromised component, affecting other Oracle E-Business Suite products sharing the same platform or data tier.