CVE-2026-83136

A high-severity (CVSS 8.8) vulnerability in the Internal Operations component of Oracle Spares Management, part of Oracle E-Business Suite, allows a low-privileged authenticated attacker with HTTP network access to fully compromise the Spares Management product. Exploitation is rated as easy (low attack complexity, no user interaction), meaning any valid account with minimal privileges on an affected instance is sufficient. A successful attack results in complete takeover, with high impact on confidentiality, integrity, and availability of the affected module. All E-Business Suite 12.2.3 through 12.2.15 installations running Spares Management are affected. No public proof-of-concept exists and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating no known in-the-wild exploitation to date.

What to do: Apply the Oracle Critical Patch Update that addresses this flaw to all E-Business Suite 12.2.3-12.2.15 environments running Spares Management, and verify the Internal Operations component is included in the patch coverage. Restrict HTTP access to EBS via network segmentation or a reverse proxy so the module is not reachable by untrusted networks, and review low-privileged account activity in Spares Management for signs of abuse. Oracle's standard guidance is to apply the latest cumulative CPU rather than individual patches.