CVE-2026-83131

Oracle Web Applications Desktop Integrator (Web ADI), a component of Oracle E-Business Suite, contains an easily exploitable flaw in its File download functionality affecting versions 12.2.3 through 12.2.15. A low-privileged attacker with valid E-Business Suite credentials and network access via HTTPS can trigger the flaw to gain unauthorized access to critical data, potentially including complete access to all data reachable through Web Applications Desktop Integrator. The CVSS 3.1 base score is 7.7 (high) with confidentiality-only impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), and the scope-change metric means successful attacks may significantly affect additional Oracle products beyond Web ADI itself. Any organization running Oracle E-Business Suite release 12.2.3-12.2.15 with Web ADI deployed is affected. No public proof of concept exists, the flaw is not on CISA's KEV, and no in-the-wild exploitation has been reported.

What to do: Apply the Oracle Critical Patch Update containing the fix for CVE-2026-83131 to all Oracle E-Business Suite 12.2.3-12.2.15 environments, prioritizing instances reachable from the internet or by broad user populations. Restrict HTTPS access to EBS via VPN or IP allowlisting so low-privileged users cannot reach Web ADI endpoints unnecessarily. Review web server and EBS access logs for anomalous file-download requests by low-privilege accounts to Web ADI endpoints, which would indicate attempted exploitation.