CVE-2026-83163

CVE-2026-83163 is a high-severity (CVSS 8.8) vulnerability in the Attachments / File Upload component of the Oracle Application Object Library, part of Oracle E-Business Suite releases 12.2.3 through 12.2.15. A low-privileged attacker — meaning any holder of a basic valid application account — with network access via HTTP can abuse the file upload/attachment handling to fully compromise the Oracle Application Object Library. A successful attack results in complete takeover, with high impact on confidentiality, integrity, and availability of the affected E-Business Suite component. Oracle rates the flaw as easily exploitable, so any internet-facing or broadly reachable EBS 12.2 deployment with ordinary application users is at material risk. The flaw was fixed in an Oracle Critical Patch Update; there is no known public proof of concept and no confirmed exploitation in the wild as of this analysis.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-83163 to all E-Business Suite 12.2.3-12.2.15 environments as a priority. Until patched, restrict HTTP access to EBS application tiers to trusted networks or VPN and place a WAF/reverse proxy in front, since exploitation requires only a low-privileged account. Review attachment upload directories for unexpected or webshell-like files and audit low-privilege application accounts for anomalous upload activity.