CVE-2026-83116

CVE-2026-83116 is a high-severity (CVSS 3.1: 7.7) vulnerability in the Product Diagnostic Tools component of Oracle Order Management, part of Oracle E-Business Suite releases 12.2.5 through 12.2.15. A low-privileged attacker with network access via HTTP — for example, any authenticated EBS user such as a self-service or read-only account — can easily trigger the flaw without user interaction. Because the vulnerability exhibits a scope change (S:C), successful attacks can significantly impact products beyond Oracle Order Management itself, and can result in unauthorized access to critical data or complete access to all Oracle Order Management accessible data; the impact is confidentiality-only (no integrity or availability impact). Organizations running EBS 12.2 with the Order Management module exposed to broad user populations or untrusted networks are the most at risk. The issue is not on the CISA Known Exploited Vulnerabilities list and no public proof-of-concept is known, suggesting exploitation in the wild is unlikely at this time.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-83116 to all EBS 12.2 environments running Order Management 12.2.5-12.2.15. Restrict HTTP access to the EBS application tier (VPN, allow-listing, WAF rules) and minimize the number of low-privileged self-service accounts that can reach the Product Diagnostic Tools functionality. Review application and diagnostic-tool access logs for unusual data retrieval by low-privilege accounts, and verify the patch level of any EBS instance currently internet-exposed.