A remote access vulnerability in Oracle Financials Common Modules allows an attacker with low privileges and network access over HTTP to compromise the application. The flaw can be exploited easily, giving the attacker unauthorized read access to confidential data and the ability to insert, update, or delete some data. The CVSS 3.1 vector indicates a high confidentiality impact (C = H) and a lower integrity impact (I = L), with no availability impact.

The affected product is Oracle Financials Common Modules, version range 12.2.3 through 12.2.15 inclusive. Versions outside this range are not reported as impacted. Because the vulnerability carries a scope change, additional Oracle E‑Business Suite components that rely on the Common Modules may also be at risk.

The CVSS base score of 8.5 signals substantial risk. The EPSS score of < 1 % indicates only a very small probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via the standard web interface over HTTP; attackers initiate exploitation from remote positions and then use the gained low‑privilege access to read or tamper with data in the Common Modules. The scope expansion could allow an attacker to affect other modules that share the compromised data store.