Introduction
Oracle Financials Common Modules is a shared component layer that underpins financial operations across Oracle E-Business Suite. It now has a high-severity vulnerability that can cross security boundaries and expose critical financial data to any authenticated user with minimal privileges. The CVSS 8.5 score is one reason to pay attention. The other is the platform's recent history: the Cl0p ransomware group and suspected FIN11 operators have kept Oracle EBS under sustained, documented attack throughout 2025 and into 2026, and earlier EBS zero days led to breaches affecting millions of individuals.
CVE-2026-46820 was disclosed on May 28, 2026 in Oracle's first monthly Critical Security Patch Update (CSPU), the first release since the company moved from a quarterly to a monthly patch cadence. The vulnerability affects Oracle EBS versions 12.2.3 through 12.2.15. That range spans about a decade of releases and covers every currently supported version of the platform.
Technical information
Vulnerability characteristics
CVE-2026-46820 is in the Common Components subcomponent of Oracle Financials Common Modules. The NVD description calls it "easily exploitable" and says it allows "a low privileged attacker with network access via HTTP to compromise Oracle Financials Common Modules." No CWE classification has been assigned, and no specific technical root cause (such as SQL injection, SSRF, or insecure direct object reference) has been publicly disclosed.
The full CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, which breaks down as follows:
| CVSS Metric | Value | Significance |
|---|---|---|
| Attack Vector (AV) | Network (N) | Exploitable remotely over the network. No physical or local access required |
| Attack Complexity (AC) | Low (L) | No specialized conditions needed. Exploitation is repeatable and reliable |
| Privileges Required (PR) | Low (L) | Any authenticated low-privilege account suffices |
| User Interaction (UI) | None (N) | No victim interaction needed for exploitation |
| Scope (S) | Changed (C) | Impact crosses security boundaries to additional products |
| Confidentiality (C) | High (H) | Complete access to all Financials Common Modules data |
| Integrity (I) | Low (L) | Unauthorized insert, update, or delete of some accessible data |
| Availability (A) | None (N) | No direct impact on system availability |
Why the scope change matters
The scope change designation (S:C) is the most architecturally significant part of this vulnerability. In CVSS 3.1 terms, a scope change means the vulnerable component and the impacted component are different. The flaw sits in Oracle Financials Common Modules, but the NVD advisory states outright that "attacks may significantly impact additional products." In practice, an attacker who compromises the Financials Common Modules may be able to use that foothold against other Oracle EBS products that share the same application tier infrastructure.
That matters here because Oracle Financials Common Modules is a shared component layer. It provides common functionality that other EBS modules depend on, including subledger accounting, payables and receivables processing, and intercompany settlement data.
Attack surface
The attack requires HTTP network access and low-privilege authentication, so an attacker needs at least one valid low-privilege credential on the Oracle EBS instance. The attack surface includes:
- Internal corporate networks where EBS web tier components are accessible
- Internet-facing EBS deployments (which are more common than many organizations realize)
- Any environment where low-privilege credentials can be obtained through credential stuffing, phishing, or insider access
Impact assessment
Successful exploitation produces two categories of impact:
-
Confidentiality (High): The NVD description specifies "unauthorized access to critical data or complete access to all Oracle Financials Common Modules accessible data." That covers financial transactions, subledger accounting data, payables and receivables information, and intercompany settlement data.
-
Integrity (Low): "Unauthorized update, insert or delete access to some of Oracle Financials Common Modules accessible data." CVSS rates this Low, but any unauthorized change to financial data has significant compliance and audit consequences under frameworks like SOX, IFRS, and GAAP.
Contextual attack pattern analysis
The exact exploit mechanism for CVE-2026-46820 has not been publicly documented, but earlier Oracle EBS vulnerabilities have been exploited in a consistent way. Google Threat Intelligence Group documented that CVE-2025-61882 exploitation combined Server-Side Request Forgery (SSRF), Carriage Return Line Feed (CRLF) injection, authentication bypass, and XSL template injection to achieve remote code execution. That attack chain targeted /OA_HTML/configurator/UiServlet and /OA_HTML/SyncServlet and created malicious templates in the XDO_TEMPLATES_B database table, which were then triggered through the Template Preview functionality.
Across these Oracle EBS vulnerabilities, the OA_HTML servlet infrastructure and the BI Publisher/XDO template framework keep showing up as the attack surfaces. CVE-2026-46820 also involves an HTTP-accessible component with a scope change, so it is plausible that the Common Components subcomponent exposes a similar attack surface. No public source has confirmed this.
Comparative analysis
Comparing CVE-2026-46820 with recent Oracle EBS vulnerabilities helps calibrate the risk:
| Dimension | CVE-2026-46820 | CVE-2025-61882 | CVE-2025-61884 |
|---|---|---|---|
| CVSS Score | 8.5 | 9.8 | 7.5 |
| Authentication Required | Low privilege | None (unauthenticated) | None (unauthenticated) |
| Affected Component | Financials Common Modules | Concurrent Processing / BI Publisher | Configurator Runtime UI |
| Scope Change | Yes | Not specified | Not specified |
| Confidentiality Impact | High | Critical | Moderate |
| Known Exploitation | Not confirmed | Yes (Cl0p/FIN11, CISA KEV) | Not independently confirmed |
The biggest difference is authentication. CVE-2026-46820 requires low-privilege credentials, whereas CVE-2025-61882 was exploitable without authentication. That narrows the immediate attack surface but does not remove the threat, because low-privilege credentials are commonly obtainable. The scope change in CVE-2026-46820, absent in the other two CVEs, means the blast radius extends beyond the Financials Common Modules.
Affected systems and versions
The vulnerability affects the Oracle Financials Common Modules product of Oracle E-Business Suite, specifically the Common Components subcomponent.
Affected versions: Oracle E-Business Suite 12.2.3 through 12.2.15
That range covers every currently supported release of Oracle E-Business Suite, so any organization running a supported EBS version is affected.
Vendor security history
Oracle E-Business Suite has had a run of significant security incidents in recent years:
| Incident | CVE | CVSS | Details |
|---|---|---|---|
| EBS Concurrent Processing RCE (Zero Day) | CVE-2025-61882 | 9.8 | Unauthenticated RCE via BI Publisher Integration. Exploited as a zero day from August 2025 and added to the CISA KEV catalog |
| EBS Configurator Data Exposure | CVE-2025-61884 | 7.5 | Unauthenticated data exposure in Configurator Runtime UI, patched October 2025 |
| Oracle Cloud Breach | CVE-2021-35587 | N/A | Threat actor "rose87168" exfiltrated 6M records affecting 140,000+ tenants via SSO/LDAP vulnerabilities |
| University of Phoenix Breach | CVE-2025-61882 | 9.8 | 3.5 million individuals affected. Hackers exploited zero-day vulnerabilities in Oracle EBS |
Oracle passed SAP in 2024 to become the No. 1 ERP applications provider, so the security posture of its EBS platform concerns much of the industry. The April 2026 CPU alone addressed 481 security vulnerabilities across Oracle's product portfolio. The move to monthly CSPUs from May 2026 reflects Oracle's acknowledgment that a quarterly cadence could not keep up with the volume and severity of the vulnerabilities being discovered.
EBS vulnerabilities keep arriving with HTTP-based attack vectors, low-privilege requirements, and scope change. That recurrence reflects a systemic characteristic of the platform's architecture. Threat actors have built repeatable tooling designed specifically to exploit the Oracle EBS architecture: the GOLDVEIN downloader, the SAGE infection chain, and XDO template injection techniques.
Threat landscape context
As of May 29, 2026, public sources show no confirmed evidence of active exploitation of CVE-2026-46820, and no proof-of-concept exploit code has been published. That is expected for a CVE published only one day earlier.
The broader threat landscape still warrants attention.
Cl0p ransomware / suspected FIN11 (UNC5936): Beginning September 29, 2025, threat actors claiming affiliation with the Cl0P extortion brand sent extortion emails to executives and alleged they had stolen data from their Oracle EBS systems. To back up the claims, the actors supplied legitimate file listings from victim EBS environments, with data dating back to mid-August 2025. The compromised accounts that sent these emails came from infostealer malware logs.
FIN11 linkage: Google Threat Intelligence Group identified logical similarities between the Cl0P EBS campaign and suspected FIN11 operations (UNC5936). The GOLDVEIN.JAVA downloader used in EBS attacks resembles the GOLDVEIN downloader and GOLDTOMB backdoor that UNC5936 deployed during the mass exploitation of the Cleo MFT vulnerability in late 2024.
Exploitation timeline for CVE-2025-61882:
| Date | Event |
|---|---|
| July 2025 | Mandiant identifies suspicious activity targeting Oracle EBS servers |
| August 9, 2025 | Earliest confirmed exploitation of CVE-2025-61882 as zero day |
| October 3, 2025 | Exploit leaked in Telegram group |
| October 4, 2025 | Oracle releases emergency patch |
| September 29, 2025 onward | Cl0P extortion campaign targeting EBS victims |
The CVSS vector for CVE-2026-46820 matches the exploitation profile of earlier EBS CVEs that attackers exploited successfully. The scope change raises the potential payoff for attackers, because compromising Financials Common Modules may let them move laterally into additional EBS modules. Organizations should not wait for confirmed exploitation before prioritizing remediation.
Recommended actions
Oracle has addressed CVE-2026-46820 in the Critical Security Patch Update for May 2026, released on May 28, 2026. This CSPU contains 12 new security patches for Oracle E-Business Suite. Organizations should:
- Download and apply the May 2026 CSPU from Oracle's security alerts page
- Run the EBS Java Critical Patch Update Checker (EJCPUC) on both the application tier and the database tier before applying patches
- Restrict outbound internet access from EBS servers to reduce the risk of data exfiltration after a successful exploitation attempt
- Monitor network logs for indicators of compromise, particularly unusual HTTP requests targeting OA_HTML servlets and Financials Common Modules endpoints
- Hunt for malicious templates in the
XDO_TEMPLATES_BandXDO_LOBSdatabase tables, looking for entries withTemplateCodestarting withTMPorDEFandTemplateTypeset toXSL-TEXTorXMLthat authorized administrators did not create - Minimize internet-facing EBS exposure by placing web tier components behind a reverse proxy or WAF
- Consider upgrading to Oracle AI DB 26ai or DB 19c so that security patches remain available
For patching priority, internet-facing systems should be patched within 72 hours and internally facing systems within two weeks. Easy exploitability, sensitive financial data, and an active threat actor ecosystem targeting Oracle EBS together justify these aggressive timelines.
References
- NVD: CVE-2026-46820
- Oracle Security Critical Patch Update Advisory, May 2026
- Oracle Critical Patch Updates and Security Alerts
- Google Threat Intelligence: Oracle E-Business Suite Zero-Day Exploited in Widespread Attacks
- HIPAA Journal: Cl0p Mass Exploiting Zero-day Vulnerability in Oracle E-Business Suite
- Oracle Financials Common Modules Documentation
- April 2026 Updates to EBS Java Critical Patch Update Checker (EJCPUC)
- BitSight: CVE-2025-61882 in Oracle E-Business Suite
- Zeropath: Oracle E-Business Suite CVE-2025-61884 Summary
- Qualys: Oracle Critical Patch Update, April 2026 Security Update Review
- Cybersecurity Dive: Oracle E-Business Suite Exploitation Traced Back to July
- Oracle EBSTech: Reminder to Upgrade to Oracle AI DB 26ai or DB 19c
- Apps Run the World: Oracle Surpasses SAP as No. 1 ERP Apps Provider
