EUVD-2026-33043
GHSA-736v-m8w8-qf99
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege EBS account
-
DeliveryReach Financials Common Modules HTTP endpoint
-
ExploitSend crafted authorization-bypassing request
-
ExecutionCross scope into other Financials modules
-
PersistExfiltrate confidential financial data
-
ImpactModify subset of records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the EBS application tier over HTTP and a valid low-privileged Oracle E-Business Suite account on a deployment running Oracle Financials Common Modules version 12.2.3 through 12.2.15 with Common Components enabled (the default in standard EBS Financials installations). No user interaction is needed and attack complexity is low. Limiting factors: the attacker must possess valid credentials for any EBS responsibility (PR:L, not PR:N), exploitation is constrained to EBS 12.2.x - earlier 12.1.x or 11i releases are not listed as affected - and the impact is bounded to confidentiality (high) and partial integrity, with no availability effect, so service disruption is not a direct outcome. |
| Impact | The CVSS 3.1 base score of 8.5 reflects a low-complexity, network-reachable attack requiring only low privileges (PR:L) and no user interaction, with high confidentiality impact, low integrity impact, and no availability impact, plus a scope change that elevates real-world severity. EPSS data was not provided and the CVE is not in CISA KEV, so widespread automated exploitation is not currently evidenced. The 'Authentication Bypass' tag conflicts somewhat with the CVSS PR:L value - CVSS treats this as requiring an authenticated session rather than full bypass, so the tag likely refers to bypassing inter-module authorization rather than initial login; defenders should verify this with Oracle before assuming pre-auth exposure. Because EBS instances frequently hold regulated financial data and any authenticated EBS user (including self-service accounts) could potentially exploit this, treat as a high-priority patch despite absence of public exploit signals. |
| Exploit ScenarioDerived | An attacker who already has a low-privileged EBS account (for example, a self-service supplier, employee, or customer portal user) sends crafted HTTP requests to a Financials Common Modules endpoint to read confidential financial records from other modules and tamper with a subset of records. Because of the CVSS scope change, the impact extends to data owned by downstream Oracle Financials products beyond Common Modules itself. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 28, 2026
Cross-product data exposure in Oracle Financials Common Modules (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged authenticated attacker to access or modify sensitive financial data over HTTP. The scope-changed nature of the flaw means exploitation impacts additional Oracle products beyond Financials Common Modules itself. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
RemediationAI
Apply the fixes from Oracle's May 2026 Critical Patch Update as documented at https://www.oracle.com/security-alerts/cspumay2026.html; exact patched build numbers are listed in that advisory and should be applied to all EBS 12.2.3-12.2.15 environments. If immediate patching is not possible, compensating controls include restricting network access to the EBS application tier (especially the Oracle iSupplier/iStore/self-service portals) to trusted corporate networks or VPN only, auditing and minimizing low-privileged accounts that can reach Financials Common Modules endpoints, and enabling URL firewall rules in EBS to block non-essential responsibilities and functions - note that aggressive URL filtering can break legitimate self-service workflows and should be tested in a non-production environment first. No vendor-confirmed workaround that fully mitigates without patching was published in the available references.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Common Components module within Oracle Financials Common Modules, a shared layer of Oracle E-Business Suite (EBS) 12.2.x used across financial applications such as General Ledger, Payables, and Receivables. The CPE string cpe:2.3:a:oracle_corporation:oracle_financials_common_modules confirms the targeted product family. The CVSS scope change (S:C) indicates the vulnerable component can affect resources beyond its own security authority - typical in EBS where Common Modules brokers data and authorization for multiple downstream financial products. No CWE is assigned, but the 'Authentication Bypass' tag combined with PR:L suggests an authorization or access-control weakness reachable post-login that escalates an ordinary EBS user's effective privileges across module boundaries.
Know when Oracle Financials Common Modules gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Primary rating from Vendor (oracle) · only source for this CVE.
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Common Components). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financials Common Modules. While the vulnerability is in Oracle Financials Common Modules, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Financials Common Modules accessible data as well as unauthorized update, insert or delete access to some of Oracle Financials Common Modules accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).
Executive ViewAI
Oracle Financials Common Modules in E-Business Suite versions 12.2.3-12.2.15 exposes sensitive financial data to unauthorized access and modification by authenticated users; no public exploit identified at time of analysis, though the vulnerability affects multiple dependent Oracle products. Organizations using these versions face direct risk to financial data integrity, potential unauthorized transactions, and regulatory violations. Immediate response is critical, as patches are not currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) network segmentation restricting HTTP access to Financials Common Modules to trusted internal networks only; (2) application-level access controls limiting low-privileged account data visibility and modification capabilities; (3) comprehensive real-time monitoring and alerting on unauthorized financial data access or changes; (4) forensic audit of financial transaction logs for anomalies since deployment.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB