CVE-2026-83072

The Oracle Applications Framework component of Oracle E-Business Suite contains an easily exploitable flaw in the Search Bean (including Advanced) component. A low-privileged attacker with network access via HTTP who triggers the flaw can compromise the Applications Framework, gaining unauthorized ability to create, delete, or modify critical data as well as read access to critical data or all framework-accessible data. Deployments running E-Business Suite releases 12.2.3 through 12.2.15 are affected. The issue carries a CVSS 3.1 base score of 8.1 (high), is not on CISA's Known Exploited Vulnerabilities list, and no public proof of concept is known, so exploitation in the wild is not currently observed.

What to do: Apply the Oracle Critical Patch Update that remediates this flaw — every listed release (12.2.3–12.2.15) is affected, so patching is required rather than a version upgrade within that range. Restrict HTTP access to EBS/OAF pages, especially self-service and search endpoints, to trusted networks or VPN, and minimize low-privilege account sprawl since exploitation requires only an authenticated session. Review audit logs for anomalous Search Bean / Advanced Search activity and unexpected data changes made by low-privilege users.