CVE-2026-83110

CVE-2026-83110 is an easily exploitable flaw in the Audience component of Oracle Marketing within Oracle E-Business Suite, affecting releases 12.2.3 through 12.2.15. An unauthenticated attacker with network access to the server over HTTP can send requests that compromise Oracle Marketing, resulting in unauthorized access to critical data or complete access to all Oracle Marketing-accessible data. The vulnerability is confidentiality-only (CVSS 3.1 base 7.5: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), so it does not allow modification or denial of service, but the exposed marketing data (e.g., audience/contact information) can be highly sensitive. Organizations running affected E-Business Suite releases with the Oracle Marketing module exposed to network users are at risk, particularly if the web tier is internet-facing. No public proof-of-concept exists and the flaw is not on the CISA Known Exploited Vulnerabilities list, so exploitation is currently considered unlikely but plausible given how trivially the bug can be reached.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83110 to your E-Business Suite 12.2 environment as soon as your patch cycle allows. Until patched, restrict network access to EBS HTTP endpoints (especially the Marketing/Audience servlets) at the firewall or reverse proxy so only trusted users and VPN ranges can reach them. Review HTTP access logs and Marketing data access for anomalous unauthenticated requests to detect any attempted or successful harvesting of audience data.