CVE-2026-83126

CVE-2026-83126 is a high-severity (CVSS 7.6) flaw in the Internal Operations component of Oracle Sales Online, part of Oracle E-Business Suite, affecting releases 12.2.3 through 12.2.15. A low-privileged authenticated attacker with HTTP network access can easily trigger the flaw, but exploitation requires interaction from a victim other than the attacker — a pattern typical of CSRF-style attacks where a legitimate user is tricked into performing an action. Because of a scope change, a successful attack can significantly impact products beyond Oracle Sales Online itself, and yields unauthorized access to critical data or complete access to all Sales Online accessible data, plus unauthorized update, insert, or delete access to some of that data; availability is not affected. Organizations running the affected E-Business Suite 12.2 releases with Sales Online deployed are at risk. No public proof-of-concept exists, the flaw is not on the CISA KEV list, and no exploitation in the wild has been reported.

What to do: Apply the Oracle Critical Patch Update that remediates this issue; affected versions are 12.2.3-12.2.15, so patch to the fixed release covered by the latest CPU. If patching is delayed, restrict HTTP access to Sales Online/EBS to trusted networks or VPN rather than exposing it to the internet, and audit low-privileged accounts for anomalous data access or unexpected updates. Because exploitation requires victim interaction, remind users not to click unsolicited links or approve unexpected requests while authenticated to EBS.