Description
Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Common Components). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financials Common Modules. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financials Common Modules accessible data as well as unauthorized access to critical data or complete access to all Oracle Financials Common Modules accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-09-15
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Data Integrity & Confidentiality Breach
Action: Apply Fix
AI Analysis

Impact

A flaw in Oracle Financials Common Modules permits an attacker with only network access through HTTP to create, delete, or alter data that normally requires higher privileges. The vulnerability is a form of unchecked access control, allowing unauthorized users to compromise the confidentiality and integrity of financial data. This weakness is identified as CWE-284, Unauthorized Access.

Affected Systems

Oracle Corporation’s Oracle Financials Common Modules, versions 12.2.3 through 12.2.15, are affected. The flaw resides in the Common Components of the E-Business Suite and can be exploited in any deployment of those specific versions.

Risk and Exploitability

The base CVSS score of 8.1 denotes a high severity, while the EPSS score of less than 1% suggests that exploitation is presently uncommon. The vulnerability is not listed in the CISA KEV catalog, but it can still be user who can reach the HTTP data manipulation rights, compromising both confidentiality and the low effort and no special conditions, the threat remains significant for exposed systems.

Generated by OpenCVE AI on September 18, 2026 at 17:54 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Verify Oracle’s available security updates for versions 12.2.3 through 12.2.15 and apply the patch as soon as it is released
  • Restrict HTTP access to the Oracle Financials Common Modules only to trusted IP addresses or networks, using firewall rules or VPN
  • Implement continuous monitoring of database transaction logs and security alerts to detect unauthorized data manipulation

Generated by OpenCVE AI on September 18, 2026 at 17:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification in Oracle Financials Common Modules via HTTP

Thu, 17 Sep 2026 01:00:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification in Oracle Financials Common Modules via HTTP
Weaknesses CWE-284

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Common Components). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financials Common Modules. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financials Common Modules accessible data as well as unauthorized access to critical data or complete access to all Oracle Financials Common Modules accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle financials Common Modules
CPEs cpe:2.3:a:oracle:financials_common_modules:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle financials Common Modules
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Financials Common Modules
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-18T18:23:46.755Z

Reserved: 2026-08-31T15:40:57.359Z

Link: CVE-2026-83446

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T20:18:53.287

Modified: 2026-09-18T19:17:02.830

Link: CVE-2026-83446

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-18T18:00:11Z

Weaknesses