CVE-2026-83152

CVE-2026-83152 is a high-severity (CVSS 8.1) vulnerability in the Internal Operations component of Oracle Project Intelligence, part of Oracle E-Business Suite releases 12.2.3 through 12.2.15. It is easily exploitable by a low-privileged (authenticated) attacker who has network access to the EBS instance over HTTP, requiring no user interaction. A successful attack lets the attacker create, delete, or modify critical data — or all Oracle Project Intelligence accessible data — as well as read critical data or gain complete access to all Project Intelligence accessible data; availability is not impacted. Organizations running the affected EBS 12.2 releases with Oracle Project Intelligence deployed are exposed, particularly where the application is reachable over the network by broad user populations. No public proof-of-concept exists and the flaw is not on the CISA KEV list, so exploitation is not known to be occurring in the wild.

What to do: Apply Oracle's Critical Patch Update that remediates CVE-2026-83152 to all EBS 12.2.3-12.2.15 environments running Project Intelligence, and verify the patch is in place on every affected instance. Restrict HTTP/network access to EBS to trusted users and segments, and enforce least-privilege roles so low-privileged accounts cannot reach Project Intelligence functions unnecessarily. Review audit logs for unexpected creation, modification, or deletion of Project Intelligence data by low-privileged accounts to rule out prior exploitation.