CVE-2026-83120

CVE-2026-83120 is a flaw in the Internal Operations component of Oracle Alert, part of Oracle E-Business Suite, affecting releases 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit it easily (CVSS 3.1: 8.8) to fully compromise the Oracle Alert component, with high impact on confidentiality, integrity, and availability — effectively a takeover. Successful exploitation requires only a valid low-privilege account on the EBS instance, making insiders or any compromised credentials a viable path. Organizations running affected E-Business Suite 12.2 releases that expose the Oracle Alert component are at risk. No public proof-of-concept is known and the flaw is not on the CISA KEV list, so exploitation in the wild is not currently indicated.

What to do: Apply the Oracle Critical Patch Update patch for Oracle Alert on all E-Business Suite 12.2.3-12.2.15 environments, prioritizing internet-reachable instances. Restrict HTTP access to EBS via VPN/IP allow-listing and enforce least-privilege on EBS user accounts since exploitation requires only a low-privileged login. Review Oracle Alert logs and configurations for unauthorized changes or unexpected activity.