EUVD-2026-33044
GHSA-qwrj-x667-58f7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed EBS portal
-
DeliveryRegister or reuse low-priv account
-
ExploitAuthenticate via HTTP
-
ExecutionSend crafted request to Financials Common Modules
-
PersistBypass authorization across scope boundary
-
ImpactExfiltrate confidential financial data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) network HTTP reachability to the Oracle E-Business Suite middle tier hosting Financials Common Modules, (2) a valid low-privileged authenticated session on EBS 12.2.3 through 12.2.15 - which is trivially satisfied where external self-service portals such as iSupplier, iStore, or iReceivables allow account registration, and (3) the target deployment running an affected Financials Common Modules component. Limiting factors: no user interaction is needed, but authentication (PR:L) is required, so EBS instances that block external registration and isolate the middle tier behind VPN/IP allowlisting substantially raise the bar; impact is confidentiality-only (C:H/I:N/A:N), so the vulnerability cannot be used directly to modify ledgers or cause outages. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) describes network-reachable, low-complexity exploitation by an authenticated user with low privileges, yielding high confidentiality impact across a wider trust boundary (S:C) but no integrity or availability impact. There is no EPSS score, KEV listing, or POC indication in the supplied data, so signals suggest moderate but not urgent priority - confidentiality-only impact and the PR:L precondition reduce mass-exploitation likelihood. However, EBS deployments routinely host self-registered customer/supplier accounts (iSupplier, iStore, iReceivables) that satisfy 'low privileges' trivially, which makes the practical exposure higher than PR:L alone implies. KEV/EPSS/POC data is absent rather than confirmed-negative, so this assessment may shift once Oracle CPU follow-up intelligence appears. |
| Exploit ScenarioDerived | An attacker registers or compromises a low-privileged EBS account (for example via an internet-facing iSupplier or iStore portal), sends a crafted HTTP request to a Financials Common Modules endpoint, and abuses the authorization flaw to read confidential financial data belonging to other tenants/modules - with the scope change allowing exfiltration of data outside the Financials Common Modules trust boundary. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 28, 2026
Unauthorized data access in Oracle E-Business Suite's Financials Common Modules (versions 12.2.3 through 12.2.15) allows low-privileged remote attackers to read sensitive data via HTTP, with a scope change that extends impact beyond the vulnerable component to other Oracle products. The flaw carries a CVSS 3.1 base score of 7.7 reflecting high confidentiality impact, but no public exploit has been identified at time of analysis and the issue is not currently listed in CISA KEV.
RemediationAI
Apply the fix delivered in the Oracle Critical Patch Update of May 2026 referenced at https://www.oracle.com/security-alerts/cspumay2026.html; Oracle did not publish a discrete fix version in the data provided, so the remediation is 'Patch available per vendor advisory' via the CPU bundle for EBS 12.2.x. If immediate patching is not possible, restrict network reachability of the EBS middle tier and Financials Common Modules endpoints to trusted internal networks via WAF or reverse-proxy ACLs, disable or tightly scope self-registration for externally facing iSupplier/iStore/iReceivables portals to eliminate trivial PR:L footholds, and audit application-tier accounts with minimal privileges - noting these controls reduce attacker reach but will break legitimate external supplier/customer self-service flows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle E-Business Suite (EBS) is Oracle's enterprise resource planning (ERP) platform; the Financials Common Modules provide shared services (UI, reporting, lookups) used across General Ledger, Payables, Receivables, and other financial modules. The CPE identifies oracle_financials_common_modules as the affected application within the EBS 12.2.x release line. No CWE was assigned, but the vendor-applied 'Authentication Bypass' tag combined with PR:L and a scope change suggests a flaw where an authenticated low-privileged session can reach functionality or data normally gated by stricter authorization, with the cross-component blast radius typical of EBS's shared servlet/middle-tier architecture.
Know when Oracle Financials Common Modules gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Primary rating from Vendor (oracle) · only source for this CVE.
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Common Components). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financials Common Modules. While the vulnerability is in Oracle Financials Common Modules, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Financials Common Modules accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
Executive ViewAI
Oracle E-Business Suite Financials modules (versions 12.2.3-12.2.15) contain a remote data access vulnerability allowing low-privileged users to extract sensitive financial data via HTTP, with scope change extending exposure to other Oracle products in the enterprise. This directly threatens confidentiality of non-public financial information and creates immediate compliance risk (SOX, data privacy regulations) and fraud exposure. Urgent mitigation and access controls are critical until vendor remediation becomes available.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce strict access controls limiting low-privileged account permissions to Financials modules, disable remote HTTP access where operationally feasible, implement enhanced logging and alerting on sensitive financial data queries, require multi-factor authentication for any remaining remote access, and apply network segmentation isolating Financials modules from other Oracle applications pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB