CVE-2026-83142

CVE-2026-83142 is a high-severity (CVSS 3.1: 7.7) information disclosure flaw in the Internal Operations component of Oracle Proposals, which is part of Oracle E-Business Suite. It is triggered by a low-privileged, authenticated attacker interacting with the vulnerable component over the network via HTTP, with no user interaction required. A successful attack results in unauthorized access to critical data or complete access to all Oracle Proposals accessible data, and because the vulnerability carries a scope change (S:C), successful attacks may also significantly impact additional Oracle E-Business Suite products beyond Oracle Proposals. The impact is purely on confidentiality — there is no integrity or availability effect. There is no known public proof-of-concept, the CVE is not on the CISA Known Exploited Vulnerabilities list, and no exploitation in the wild has been reported.

What to do: Apply the latest Oracle Critical Patch Update that remediates this issue for Oracle E-Business Suite 12.2 and confirm the patch level covers Oracle Proposals versions 12.2.3-12.2.15. Restrict HTTP/HTTPS access to EBS environments (VPN or IP allowlisting) and enforce least-privilege role assignments so ordinary accounts cannot reach sensitive Proposals data. Review EBS audit and access logs for anomalous data reads by low-privileged users of the Proposals/Internal Operations component.