CVE-2026-46821: Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Common Components)

Synopsis

An unauthorized data-disclosure vulnerability exists in the Common Components module of Oracle Financials Common Modules, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15. The flaw is reachable over HTTP by any low-privileged authenticated user with network access, requiring no victim interaction. Successful exploitation gives an attacker full read access to all data accessible within Oracle Financials Common Modules, and because the CVSS scope is changed, it can spill into other products sharing the same environment. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Oracle Financials Common Modules HTTP endpoint over a network; there is no requirement for local or physical access.

• AuthenticationRequired

  Any low-privilege account is sufficient; the attacker does not need administrative or elevated credentials.

• Victim interactionNot required

  No user action is needed; the attacker can exploit the vulnerability entirely on their own without tricking another user into doing anything.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, special memory layout, or other environmental preconditions.

Blast Radius

• Reads the complete set of financial data accessible to Oracle Financials Common Modules, including ledger entries, transaction records, and configuration data.
• Because the CVSS scope is changed, an attacker can leverage the initial access to read data from other Oracle E-Business Suite products running in the same environment.
• Sensitive financial records and any credentials or tokens stored within the application tier become exposed to the attacker.