CVE-2026-83083

Oracle E-Business Suite's Oracle Marketing product (Audience component) contains an easily exploitable vulnerability in versions 12.2.3 through 12.2.15 that lets a low-privileged authenticated attacker with network access via HTTP compromise Oracle Marketing. Because the flaw carries a scope change (S:C), successful attacks may also significantly impact additional products beyond Oracle Marketing itself. A successful attacker gains unauthorized access to critical data or complete read access to all Oracle Marketing-accessible data, along with unauthorized update, insert, or delete access to some of that data; availability is not impacted (CVSS 3.1: 8.5). Any organization running the affected 12.2.3–12.2.15 releases of Oracle E-Business Suite with Oracle Marketing installed is exposed, particularly if the environment is internet-facing. No public proof of concept exists and the issue is not on CISA's KEV list, so exploitation in the wild is not known.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83083 to every E-Business Suite 12.2.3–12.2.15 environment with Oracle Marketing installed. Until patched, restrict internet-facing HTTP access to EBS and review which low-privileged user accounts hold Oracle Marketing responsibilities. Audit Audience/Marketing data access and modification logs for unauthorized read, update, insert, or delete activity.