What is the CVSS score of EUVD-2026-33044?

EUVD-2026-33044 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Oracle E-Business Suite are affected by EUVD-2026-33044?

Oracle E-Business Suite Financials modules (versions 12.2.3-12.2.15) contain a remote data access vulnerability allowing low-privileged users to extract sensitive financial data via HTTP, with scope…

How to fix or mitigate EUVD-2026-33044?

Within 24 hours: Inventory all Oracle EBS instances running Financials 12.2.3-12.2.15 and audit current low-privileged user accounts with HTTP remote access; document financial data classification and DLP controls in place. Within 7 days: Restrict or disable HTTP-based remote access to affected Financials modules, enforce additional authentication requirements, and review data access logs for unauthorized extraction. Within 30 days: Network isolate affected modules if feasible, monitor Oracle security advisories for patch release (track advisory ID), conduct SOX control assessment for any unauthorized access detected.

Oracle E-Business Suite EUVD-2026-33044

| CVE-2026-46821 HIGH

Improper Access Control (CWE-284)

2026-05-28 oracle

GHSA-qwrj-x667-58f7

Authentication Bypass Oracle

7.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 21:26 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Common Components). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financials Common Modules. While the vulnerability is in Oracle Financials Common Modules, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Financials Common Modules accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Unauthorized data access in Oracle E-Business Suite's Financials Common Modules (versions 12.2.3 through 12.2.15) allows low-privileged remote attackers to read sensitive data via HTTP, with a scope change that extends impact beyond the vulnerable component to other Oracle products. The flaw carries a CVSS 3.1 base score of 7.7 reflecting high confidentiality impact, but no public exploit has been identified at time of analysis and the issue is not currently listed in CISA KEV.

Technical ContextAI

Oracle E-Business Suite (EBS) is Oracle's enterprise resource planning (ERP) platform; the Financials Common Modules provide shared services (UI, reporting, lookups) used across General Ledger, Payables, Receivables, and other financial modules. The CPE identifies oracle_financials_common_modules as the affected application within the EBS 12.2.x release line. No CWE was assigned, but the vendor-applied 'Authentication Bypass' tag combined with PR:L and a scope change suggests a flaw where an authenticated low-privileged session can reach functionality or data normally gated by stricter authorization, with the cross-component blast radius typical of EBS's shared servlet/middle-tier architecture.

RemediationAI

Apply the fix delivered in the Oracle Critical Patch Update of May 2026 referenced at https://www.oracle.com/security-alerts/cspumay2026.html; Oracle did not publish a discrete fix version in the data provided, so the remediation is 'Patch available per vendor advisory' via the CPU bundle for EBS 12.2.x. If immediate patching is not possible, restrict network reachability of the EBS middle tier and Financials Common Modules endpoints to trusted internal networks via WAF or reverse-proxy ACLs, disable or tightly scope self-registration for externally facing iSupplier/iStore/iReceivables portals to eliminate trivial PR:L footholds, and audit application-tier accounts with minimal privileges - noting these controls reduce attacker reach but will break legitimate external supplier/customer self-service flows.