CVE-2026-83113

A vulnerability in the Internal Operations component of the Oracle Quality product within Oracle E-Business Suite allows a low-privileged, authenticated attacker with network access via HTTP to compromise Oracle Quality. The flaw is rated easily exploitable (CVSS 3.1 base score 7.1) but requires valid low-level credentials to trigger. Successful exploitation can result in unauthorized access to critical data or complete read access to all Oracle Quality accessible data, as well as unauthorized update, insert, or delete access to some of that data; availability is not impacted. Organizations running E-Business Suite releases 12.2.3 through 12.2.15 with the Oracle Quality module in use are affected. No public proof-of-concept is known, the issue is not on the CISA Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83113 to all E-Business Suite 12.2.3-12.2.15 environments running Oracle Quality. Restrict HTTP access to EBS through VPN or IP allowlisting so only necessary authenticated business users can reach the Quality module, and enforce least-privilege roles for accounts that do. Review Quality module data and audit logs for unexpected reads or modifications performed by low-privileged accounts.