Oracle Financials Common Modules CVE-2026-61331

Exploitation requires a valid low-privileged authenticated session in Oracle E-Business Suite, confirmed by the CVSS PR:L metric. The attacker must have network access to the EBS application server via HTTP (AV:N), but no user interaction from a victim is required (UI:N) and attack complexity is low (AC:L), meaning no race condition, special timing, or environmental configuration is needed beyond connectivity and credentials. No non-default configuration is stated as a prerequisite - all instances of Oracle EBS 12.2.3 through 12.2.15 with the Financials Common Modules component appear affected in their default deployment. Exploitation is limited by the credential requirement: unauthenticated external attackers cannot exploit this without first obtaining an EBS account via another vector. The scope change means that once the access control is bypassed, data from other Oracle EBS modules beyond Financials Common Modules may be readable, compounding the data exposure beyond the initial authorization boundary.

The CVSS 3.1 score of 7.7 HIGH is well-supported by the vector components: AV:N (internet- or intranet-reachable), AC:L (no special conditions, timing, or race), PR:L (only requires any standard EBS user account), UI:N (no victim interaction), and S:C with C:H (cross-boundary confidentiality breach). This combination means any low-privileged EBS user - including contractors, read-only finance staff, or a compromised service account - can trigger the flaw. The 'Authentication Bypass' tag adds nuance: while a session is technically required, the vulnerability likely allows that session to bypass object-level or row-level security controls, granting access to data the account is not authorized to see. EPSS data was not provided in the available intelligence, so exploitation probability cannot be quantified probabilistically. No KEV listing and no public exploit code have been identified, which moderately reduces immediate urgency but does not eliminate priority given the sensitivity of financial data in EBS environments and the low attack complexity. For organizations running Oracle EBS in multi-tenant or shared-service configurations, the scope-change risk is elevated: one exploited account could expose data belonging to other business units or entities. The primary limiting factor is the PR:L requirement - unauthenticated external attackers cannot exploit this directly without first obtaining an EBS credential.

An attacker with any valid low-privileged Oracle EBS account - such as a contractor, temporary employee, or credential obtained through phishing - sends a crafted HTTP request to the Common Components endpoint of the Financials Common Modules application. The access control check in Common Components fails to enforce the caller's authorization scope, returning financial records or sensitive data from other EBS modules the account is not permitted to access. No public exploit code has been identified, but the AC:L rating indicates no specialized tooling or bypass chaining is required beyond knowledge of the vulnerable endpoint.