CVE-2026-83118

CVE-2026-83118 is a local privilege escalation flaw in the Applications DBA product of Oracle E-Business Suite, specifically in the AD Utilities component. A low-privileged attacker who already has an operating system logon on the server where Applications DBA executes can exploit it easily (no user interaction required) to fully compromise Applications DBA, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 7.8). Successful exploitation effectively results in takeover of the Applications DBA function, which administers the EBS database tier and could therefore expose or corrupt the underlying business data. Affected deployments are Oracle E-Business Suite releases 12.2.3 through 12.2.15 running on-premises or in hosted infrastructure where multiple OS accounts share the server. No public proof-of-concept code is known and there is no evidence of in-the-wild exploitation to date.

What to do: Apply the Oracle Critical Patch Update that remediated this flaw to all E-Business Suite 12.2.3-12.2.15 environments and verify AD Utilities is updated on both application and database tiers. Because exploitation requires local OS access, restrict and audit interactive logons on hosts running Applications DBA and enforce least-privilege on service and administrative accounts. Review local account activity and privilege escalation events on EBS servers for signs of abuse in the interim.