CVE-2026-83446 is a vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Common Components) affecting supported versions 12.2.3 through 12.2.15. The flaw allows a low-privileged attacker with network access via HTTP to compromise the module, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all accessible data within Oracle Financials Common Modules. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N with a base score of 8.1, indicating high confidentiality and integrity impacts but no availability impact. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 security patches across multiple products.

Successful exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Financials Common Modules, potentially compromising confidentiality and integrity of sensitive financial data. The attacker requires only low privileges and network access via HTTP, increasing the risk of compromise if the system is exposed. There is no reported impact on availability. No known exploits in the wild have been reported to date.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers using Oracle E-Business Suite versions 12.2.3 through 12.2.15 should apply the relevant patches without delay to remediate this vulnerability. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to mitigate exploitation risks. Patch status is confirmed by the vendor advisory indicating availability of fixes.