CVE-2026-83121

CVE-2026-83121 is a high-severity (CVSS 3.1: 8.8) vulnerability in the Audience component of Oracle Marketing, part of Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.15. It is described as easily exploitable by a low-privileged (authenticated) attacker with network access via HTTP, meaning any user with even a minimal account on an exposed instance can trigger the flaw. A successful attack allows the attacker to fully compromise Oracle Marketing, with high impact on the confidentiality, integrity, and availability of that component. Organizations running the affected E-Business Suite releases with Oracle Marketing deployed and reachable over the network are exposed, particularly where EBS web endpoints face the internet or a broad internal user base. No public proof of concept is known, the flaw is not on the CISA KEV list, and no in-the-wild exploitation has been reported to date.

What to do: Apply the Oracle Critical Patch Update that remediated this flaw to all E-Business Suite 12.2.3-12.2.15 environments running Oracle Marketing, prioritizing any instance whose web tier is internet-facing. Until patched, restrict HTTP access to EBS to trusted networks/VPN, review accounts with even low-privilege roles for compromise, and audit logs for anomalous activity in the Oracle Marketing/Audience component.