CVE-2026-83127

CVE-2026-83127 is a high-severity (CVSS 3.1: 7.7) information disclosure flaw in the Internal Operations component of Oracle Sales Offline, part of Oracle E-Business Suite. A low-privileged attacker with a valid account and HTTP network access to the E-Business Suite instance can exploit the flaw easily, without user interaction, to gain unauthorized access to critical data or complete access to all data reachable through Oracle Sales Offline. Because the CVSS scope is 'changed,' successful attacks may also significantly impact products beyond the Sales Offline component itself. Organizations running Oracle E-Business Suite versions 12.2.3 through 12.2.15 with the Sales Offline product deployed are affected; the flaw has no integrity or availability impact. No public proof-of-concept exists, the CVE is not in CISA's KEV catalog, and no exploitation in the wild has been reported as of this analysis.

What to do: Apply the Oracle Critical Patch Update that delivers the fix for Oracle Sales Offline, since affected versions span 12.2.3 through 12.2.15 and no fixed version number is specified beyond the CPU. Restrict HTTP access to E-Business Suite and the Sales Offline module to trusted networks and authenticated users, and enforce least-privilege roles to limit the low-privileged accounts that could trigger the flaw. Review access logs for low-privilege accounts making unusual requests to Sales Offline Internal Operations endpoints, and verify whether additional E-Business Suite data was exposed given the scope-change impact.