CVE-2026-83129

CVE-2026-83129 is an easily exploitable information disclosure flaw in the Internal Operations component of Oracle Sales, part of Oracle E-Business Suite releases 12.2.3 through 12.2.15. A remote attacker holding a low-privileged account (any legitimate EBS user with minimal rights) can trigger the flaw over HTTP to read data they should not be authorized to see. Because the vulnerability changes scope, a successful attack can result in unauthorized access to critical data or complete access to all Oracle Sales-accessible data, and the impact may spill over into additional products beyond Oracle Sales. Only confidentiality is affected (CVSS 3.1: 7.7, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); there is no integrity or availability impact. No public proof-of-concept exists, the flaw is not on the CISA KEV list, and no exploitation in the wild has been reported.

What to do: Apply the Oracle Critical Patch Update that resolves CVE-2026-83129 to all EBS 12.2.3-12.2.15 environments running Oracle Sales. Until patched, restrict HTTP access to EBS endpoints (especially Internal Operations pages) via network segmentation, VPN, or IP allowlisting, and audit low-privileged accounts for anomalous data-access activity. Review web and application logs for suspicious authenticated requests to the Sales/Internal Operations component as an indicator of attempted exploitation.