CVE-2026-83164

Oracle Customer Interaction History, a module of Oracle E-Business Suite (Outcome-Result component), contains an easily exploitable vulnerability in supported versions 12.2.3 through 12.2.15. A remote attacker who already holds a low-privileged account and can reach the EBS web tier over HTTP can trigger the flaw, and successful attacks result in a complete takeover of Oracle Customer Interaction History. The issue carries a CVSS 3.1 base score of 8.8 with high confidentiality, integrity, and availability impacts, meaning an attacker could read, alter, or destroy data handled by the module. Organizations running the affected EBS 12.2 releases with this module in use are at risk, particularly where EBS web endpoints are reachable by broad user populations. No public proof-of-concept is known and the flaw is not on the CISA Known Exploited Vulnerabilities list, so exploitation status is currently none known.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83164 if you run E-Business Suite 12.2.3-12.2.15 with Customer Interaction History, and confirm your bundle patch level afterwards. Restrict HTTP access to the EBS application tier to trusted networks or VPN rather than exposing it to the open internet. Review audit logs for unusual activity by low-privileged accounts interacting with Customer Interaction History / Outcome-Result pages.