Quick Look: CVE-2026-46821 — Oracle EBS Financials Common Modules Confidentiality Breach with Scope Change

Introduction

Oracle's first monthly Critical Security Patch Update, released May 28, 2026, fixes a high-severity confidentiality vulnerability in Oracle E-Business Suite. A low-privileged attacker can use it to read critical financial data across multiple EBS products from a single entry point. CVE-2026-46821 sits in the Common Components layer of Oracle Financials Common Modules, shared infrastructure that underpins intercompany transactions, payables netting, receivables netting, and other cross-cutting financial operations. Its CVSS vector carries a scope change, which means the blast radius extends well beyond the module that contains the flaw.

The CVE-2025-61882 ransomware campaigns showed that threat actors, including Cl0p and associated groups, have both the capability and the motivation to target EBS deployments. CVE-2026-46821 is a different class of vulnerability (confidentiality only, and it requires authentication), but an established attacker ecosystem already works against EBS, and that warrants prompt attention.

Technical Information

Vulnerability Overview

CVE-2026-46821 affects the Common Components sub-component within Oracle Financials Common Modules, part of Oracle E-Business Suite. Oracle Financials Common Modules provides shared financial infrastructure across EBS, covering the Advanced Global Intercompany System, Payables and Receivables Netting, and other cross-cutting financial functions. The Common Components layer is likely a foundational shared service for multiple financial modules, which would explain the scope change designation.

The National Vulnerability Database published the vulnerability on May 28, 2026, with Oracle's security alert team as the source.

CVSS 3.1 Vector Breakdown

The full CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, which gives a Base Score of 7.7. The metrics break down like this:

Most of the 7.7 comes from pairing High confidentiality impact with a Changed scope. Without the scope change, a similar vulnerability would score lower. The low-privilege requirement does set this apart from CVE-2025-61882, which needed no authentication at all. In practice, though, low-privileged EBS accounts are common in enterprise environments, and attackers can obtain them through credential harvesting, phishing, or insider access.

Attack Flow

From the CVE description and the Oracle advisory, the exploitation path looks like this:

1. Network access via HTTP: The attacker reaches the Oracle EBS web tier over HTTP or HTTPS. Internet-facing EBS deployments are at highest risk, though intranet-exposed instances are also vulnerable to lateral movement from a compromised internal host.

2. Low-privilege authentication: The attacker authenticates with valid credentials that carry only basic application access. No administrative role or role specific to a financial module is required. Any standard user account with basic EBS access is enough.

3. Exploitation of Common Components: The attacker exploits the vulnerability in the Common Components layer. Because financial modules share this layer, the scope change indicates that the confidentiality breach extends to other EBS products that share the same security boundary.

4. Data access across modules: Per the NVD description, successful exploitation results in "unauthorized access to critical data or complete access to all Oracle Financials Common Modules accessible data." The scope change means this access may extend to data managed by other EBS modules that rely on the Common Components infrastructure.

Because the impact is confidentiality only (C:H/I:N/A:N), there is no direct integrity or availability degradation. Detection should focus on unauthorized data access and exfiltration patterns rather than system disruption or modification.

No CWE Classification

As of the NVD publication date, no CWE ID has been assigned to this vulnerability. That limits automated categorization and may delay integration with security tooling that relies on CWE mappings for prioritization. Without a CWE, we also cannot say for certain what the root cause is (improper access control, information disclosure, authorization bypass, or something else). The CVSS vector is consistent with an authorization or access-control flaw in the shared component layer.

Context Within the May 2026 CSPU

The May 2026 CSPU includes 12 new security patches for Oracle E-Business Suite, and CVE-2026-46821 is one of them. Here are several of the other EBS vulnerabilities fixed in the same release:

The two CVSS 9.9 vulnerabilities (CVE-2026-46822 and CVE-2026-46824) are the most urgent. Even so, CVE-2026-46821's scope change and confidentiality focus make it particularly dangerous for organizations whose sensitive financial data is spread across EBS modules.

Patch Information

Oracle fixed CVE-2026-46821 in its inaugural Critical Security Patch Update (CSPU) for May 2026, released on May 28, 2026. It is the first release under Oracle's new monthly CSPU program, a supplementary patching cadence for targeted, high-priority security fixes between the traditional quarterly Critical Patch Updates (CPUs).

The fix ships through Oracle's standard patching infrastructure. Customers with valid support contracts can find the specific patch numbers in My Oracle Support Note KA923, which the CSPU advisory references. The patch availability document for Oracle E-Business Suite (versions 12.2.3 through 12.2.15) has detailed installation instructions. As is typical of Oracle's closed-source patching model, no source-level diffs or commit details are publicly available. The remediation is distributed as binary patches through My Oracle Support.

Key patching considerations:

• Patches are provided only for product versions covered by the Premier Support or Extended Support phases of Oracle's Lifetime Support Policy. Organizations running unsupported versions must upgrade to a supported release before patching.
• The CSPU complements Oracle's quarterly cumulative CPUs, so organizations should make sure both the May 2026 CSPU and the most recent CPU are applied.
• Oracle also recommends applying the May 2026 CSPU to the Oracle Database and Oracle Fusion Middleware components in EBS environments, because "the exposure of Oracle E-Business Suite products is dependent on the versions of Oracle Database and Oracle Fusion Middleware being used."
• The May 2026 CSPU bundled 35 new security patches across several Oracle product families. E-Business Suite received 12 of them, and three of those address vulnerabilities that are remotely exploitable without authentication.

Oracle notes that "workarounds like blocking network protocols or removing unnecessary privileges might reduce risk" but explicitly cautions that these "are not long-term solutions and may impact application functionality." As interim measures, organizations may consider restricting network access to EBS web tiers, reviewing and reducing the number of low-privilege accounts with access to Financials Common Modules, and monitoring EBS audit logs for unauthorized data access patterns.

The move to monthly CSPUs is good for Oracle's security posture, but it forces organizations to speed up their own patch management cycles. Quarterly CPUs allowed 90-day planning windows. Monthly CSPUs require continuous vulnerability assessment and faster deployment.

Affected Systems and Versions

All supported versions of Oracle E-Business Suite from 12.2.3 through 12.2.15 are affected. That spans approximately 13 point releases and covers virtually every currently supported EBS 12.2 deployment.

The range goes one version past the earlier CVE-2025-61882 range (12.2.3 through 12.2.14), so version 12.2.15 is newly in scope.

The specific affected product and component:

• Product: Oracle Financials Common Modules (part of Oracle E-Business Suite)
• Sub-component: Common Components
• Versions: 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, 12.2.8, 12.2.9, 12.2.10, 12.2.11, 12.2.12, 12.2.13, 12.2.14, 12.2.15

No deployed supported version of Oracle EBS 12.2 is immune. For organizations running any version in this range, patching is the only definitive remediation path.

Vendor Security History

Oracle E-Business Suite has a well-documented history of security vulnerabilities, several of which have been actively exploited:

CVE-2025-61882 is the most instructive precedent. That critical unauthenticated remote code execution flaw in Oracle EBS versions 12.2.3 through 12.2.14 was exploited in ransomware campaigns as early as August 9, 2025, about two months before Oracle released an out-of-band patch on October 4, 2025. CISA added it to the Known Exploited Vulnerabilities catalog on October 6, 2025. The campaigns were attributed to the Cl0p ransomware group, and researchers observed signs of collaboration or code sharing with Scattered Spider, LAPSUS$, and ShinyHunters.

The April 2026 CPU alone addressed 481 security vulnerabilities across Oracle's product portfolio. The January 2026 CPU contained 8 new security patches for EBS, 2 of which were remotely exploitable without authentication.

In a separate incident, Oracle confirmed a data breach via outdated servers while denying a breach of its cloud infrastructure. That incident points to the risk of unpatched on-premises EBS deployments.

EBS vulnerabilities keep recurring, particularly in the 12.2.x range, which suggests the shared component layers have architectural weaknesses that are still being discovered. The Common Components sub-component of Financials Common Modules, where CVE-2026-46821 resides, is one of those shared layers.

References

• NVD: CVE-2026-46821
• CVE Record: CVE-2026-46821
• Oracle Security Critical Patch Update Advisory, May 2026
• Oracle Security Alerts
• Monthly Critical Security Patch Updates (CSPUs) Begin May 28, 2026
• Oracle to Release Monthly Critical Security Patch Updates (CSPUs)
• Oracle Financials Common Modules Documentation
• Oracle EBS Flaw Exploited in Active Ransomware Campaigns (CVE-2025-61882)
• Critical Vulnerability Alert: CVE-2025-61882 in Oracle E-Business Suite
• Investigation into Oracle E-Business Suite Exploit Components (CVE-2025-61882)
• Oracle Security Alert Advisory: CVE-2025-61882
• VulnCheck State of Exploitation 2026
• Oracle Critical Patch Update, April 2026 Security Update Review (Qualys)
• Oracle Critical Patch Update Advisory, January 2026
• Oracle confirms data breach via outdated servers