CVE-2026-83159

CVE-2026-83159 is a flaw in the ADPatch component of Oracle E-Business Suite's Applications DBA, affecting releases 12.2.3 through 12.2.15. It is exploitable by an unauthenticated attacker who already has operating-system logon access to the server where Applications DBA executes, but a successful attack additionally requires a legitimate person (for example, a DBA performing a patching action) to interact with the system. If those conditions are met, the attacker can fully compromise Applications DBA, with high impact on the confidentiality, integrity, and availability of the E-Business Suite environment — effectively gaining control of the account and schemas that own the applications tier. In practice, this means anyone able to place files on the EBS middleware or database tier combined with an unaware operator represents the realistic threat scenario. The flaw is not in CISA's Known Exploited Vulnerabilities catalog and no public proof of concept is known, so exploitation activity is believed to be minimal.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83159 to all E-Business Suite 12.2.3-12.2.15 environments. Restrict OS-level logon and file-write access on the applications and database tier hosts to trusted DBA and middleware accounts only, since exploitation requires local foothold plus operator interaction. Review audit logs for unexpected local users, modified patch staging directories, or anomalous adpatch sessions around patching activities.