CVE-2026-83428
HighCVSS 8.1Summary
Vulnerability in Oracle Demand Signal Repository (Oracle E-Business Suite), component Internal Operations, affecting versions 12.2.3-12.2.15. A low-privileged authenticated attacker with HTTP network access can gain unauthorized access to data and create, delete, or modify data. CVSS 3.1 Base Score 8.1.
Risk Assessment
A low-privileged attacker can compromise the confidentiality and integrity of critical business data in Oracle E-Business Suite. This may lead to data leakage or manipulation and disruption of business processes.
Recommendation
Immediately apply the Oracle Critical Patch Update for Oracle E-Business Suite and restrict network access to the Demand Signal Repository component. Also review low-privileged accounts and monitor for unusual HTTP activity.
Other vulnerabilities in Oracle E-Business Suite
See all- CVE-2026-83425High
Vulnerability in Oracle Complex Maintenance, Repair and Overhaul (Oracle E-Business Suite), component Internal Operations, affecting versions 12.2.12-12.2.15. A low-privileged authenticated attacker with HTTP network access can access critical data and cause a partial denial of service. CVSS 3.1 Base Score 8.5.
- CVE-2026-83205High
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization) affecting versions 12.2.3-12.2.15. Easily exploitable by a low privileged attacker with network access via HTTP. Successful attacks can result in takeover of the component.
- CVE-2026-83204High
Vulnerability in the Oracle Sourcing product of Oracle E-Business Suite (component: Internal Operations) affecting versions 12.2.3-12.2.15. Difficult to exploit, but allows a low privileged attacker with network access via HTTP to take over the product.
- CVE-2026-83159High
Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: ADPatch) affecting versions 12.2.3-12.2.15. An authenticated attacker with local logon can exploit it if another person performs a specific action, leading to takeover of Applications DBA.
- CVE-2026-83158High
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone) affecting versions 12.2.3-12.2.15. A low-privileged attacker with local logon can gain unauthorized access to critical data and create, delete, or modify data.
- CVE-2026-83157High
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone) affecting versions 12.2.3-12.2.15. A high-privileged attacker with network access via HTTP can take over Oracle Applications Manager, potentially impacting other products.
- CVE-2026-83152High
Vulnerability in the Oracle Project Intelligence product of Oracle E-Business Suite (component: Internal Operations) affecting versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data and create, delete, or modify data.
- CVE-2026-83142High
Vulnerability in Oracle E-Business Suite Oracle Proposals product (Internal Operations component). Affects versions 12.2.3-12.2.15. Easily exploitable, requires low privileges and network access via HTTP. Attacks may impact additional products (scope change) and lead to unauthorized access to critical data.
- CVE-2026-83141High
Vulnerability in Oracle E-Business Suite Oracle Field Service product (Internal Operations component). Affects versions 12.2.3-12.2.15. Easily exploitable, requires low privileges and network access via HTTP. Attacks may impact additional products (scope change) and lead to unauthorized access to critical data.
- CVE-2026-83138High
Vulnerability in Oracle E-Business Suite Oracle Spares Management product (Internal Operations component). Affects versions 12.2.3-12.2.15. Difficult to exploit, requires high privileges and network access via HTTP. Attacks may impact additional products (scope change) and lead to takeover of Oracle Spares Management.
Original NVD description (English source)
Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Demand Signal Repository. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Demand Signal Repository accessible data as well as unauthorized access to critical data or complete access to all Oracle Demand Signal Repository accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).