CVE-2026-46821 is a vulnerability in Oracle Financials Common Modules (part of Oracle E-Business Suite) affecting versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access over HTTP to compromise the modules, resulting in unauthorized access to critical or all accessible data. The vulnerability has a CVSS 3.1 score of 7.7 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact. The vulnerability may also impact additional Oracle products due to scope change. Oracle has addressed this vulnerability in its May 2026 Critical Security Patch Update, which includes 35 security patches across multiple products. Oracle advises customers to apply these patches without delay and to remain on supported versions. Temporary mitigations include blocking network protocols or removing unnecessary privileges, but these do not fix the underlying issue.

Successful exploitation of CVE-2026-46821 can lead to unauthorized access to critical data or complete access to all data accessible through Oracle Financials Common Modules. The vulnerability affects confidentiality but does not impact integrity or availability. Due to scope change, other Oracle products may also be significantly impacted. No known exploits in the wild have been reported, but the vulnerability is considered easily exploitable by a low privileged attacker with network access via HTTP.

Oracle has released security patches for this vulnerability as part of the May 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Until patches are applied, risk may be reduced by blocking network protocols required by the attack or by removing unnecessary privileges from users, though these are not permanent fixes and may disrupt application functionality. Oracle recommends testing any such changes in non-production environments. Customers should also ensure they are running supported product versions and have not skipped previous security updates.