CVE-2026-83130

CVE-2026-83130 is a vulnerability in the Internal Operations component of Oracle Site Hub, part of Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit it easily, requiring no user interaction, to compromise Oracle Site Hub. Successful attacks allow unauthorized creation, deletion, or modification of critical data or all Site Hub-accessible data, as well as unauthorized read access to a subset of that data — a high-impact integrity compromise (CVSS 3.1: 7.1, with C:L/I:H/A:N). Any organization running an affected E-Business Suite release with Site Hub deployed is exposed, particularly if the Site Hub endpoints are reachable by low-trust internal or external users. No public proof-of-concept exists and the flaw is not on the CISA KEV list, so exploitation is not currently known to be occurring in the wild.

What to do: Apply Oracle's Critical Patch Update that addresses CVE-2026-83130 to all Oracle Site Hub deployments running versions 12.2.3-12.2.15. Restrict HTTP access to Site Hub endpoints to trusted, authenticated users only, and review low-privileged account activity for suspicious data creation, modification, or deletion. Audit Site Hub data integrity for signs of unauthorized changes made since the vulnerable window opened.