CVE-2026-46820 is a vulnerability in the Oracle Financials Common Modules component of Oracle E-Business Suite (versions 12.2.3 to 12.2.15). It allows a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized access to critical data and partial unauthorized modification capabilities (update, insert, delete) on accessible data. The vulnerability has a CVSS 3.1 base score of 8.5, indicating high severity, with network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and low integrity impacts. Oracle has addressed this vulnerability in its May 2026 Critical Security Patch Update, which includes 35 new security patches across multiple products including Oracle E-Business Suite. Oracle strongly recommends applying these patches immediately. Workarounds such as blocking network protocols or removing unnecessary privileges may reduce risk temporarily but do not fix the underlying issue.

Successful exploitation of CVE-2026-46820 can lead to unauthorized access to critical data within Oracle Financials Common Modules and unauthorized modification (update, insert, delete) of some accessible data. The vulnerability affects confidentiality and integrity but does not impact availability. The scope of impact may extend beyond Oracle Financials Common Modules to additional products. The vulnerability is exploitable remotely over HTTP by a low privileged attacker without user interaction, increasing the risk of compromise if unpatched.

Oracle has released a security patch for this vulnerability as part of the May 2026 Critical Security Patch Update. Customers should apply this patch promptly to remediate the vulnerability. Until the patch is applied, risk may be reduced by blocking network protocols required for exploitation or by removing unnecessary privileges from users, but these are temporary measures and may impact application functionality. Oracle strongly recommends testing any such changes in non-production environments and maintaining supported product versions to ensure availability of security patches.