CVE-2026-83089

CVE-2026-83089 is a high-severity (CVSS 8.1) vulnerability in the Internal Operations component of Oracle Alert, part of Oracle E-Business Suite releases 12.2.3 through 12.2.15. It is easily exploitable by a low-privileged, already-authenticated attacker who has network access to the EBS HTTP endpoint, requiring no user interaction. Successful exploitation allows the attacker to create, delete, or modify critical Oracle Alert data and to read all data accessible to Oracle Alert, giving high impact to confidentiality and integrity (no availability impact). Organizations running affected 12.2.x releases with Oracle Alert exposed over HTTP and accessible to low-privilege accounts are at risk. There is no public proof-of-concept and no known in-the-wild exploitation to date, and the flaw is not on the CISA KEV list.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-83089 to all E-Business Suite 12.2.3-12.2.15 environments running Oracle Alert. Restrict HTTP access to EBS to trusted networks or VPN rather than exposing it to the open internet, and enforce least-privilege on EBS user accounts. Review audit logs for anomalous activity by low-privileged accounts against Oracle Alert definitions and data.