CVE-2026-83084

CVE-2026-83084 is a vulnerability in the Audience component of Oracle Marketing within Oracle E-Business Suite, affecting releases 12.2.3 through 12.2.15. It is easily exploitable by a low-privileged (authenticated) attacker with network access via HTTP, requiring no user interaction. Successful attacks result in unauthorized access to critical data or complete access to all Oracle Marketing accessible data, and because of a scope change, the impact can extend beyond Oracle Marketing to additional products. The flaw is confidentiality-only (CVSS 3.1: 7.7, C:H/I:N/A:N), so it does not allow modification or denial of service. No public proof of concept is known and the issue is not on the CISA KEV list, so there is no indication of active exploitation.

What to do: Apply the Oracle Critical Patch Update that addresses this issue for Oracle Marketing/Audience on EBS 12.2.3-12.2.15 as soon as it is available for your release track. Until patched, restrict HTTP access to the EBS application tier (VPN/IP allowlisting) and enforce least-privilege self-service accounts, since exploitation requires a low-privileged authenticated session. Review application and database audit logs for unusual data access by marketing/self-service users to rule out prior compromise.