CVE-2026-83166

CVE-2026-83166 is a confidentiality-only vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite, specifically the Outcome-Result component, affecting releases 12.2.3 through 12.2.15. It is easily exploitable by a low-privileged (authenticated) attacker with network access over HTTP, requiring no user interaction. Because the vulnerability has a scope change (CVSS S:C), a successful attack can spill beyond Customer Interaction History and significantly impact additional Oracle E-Business Suite products, resulting in unauthorized access to critical data or complete access to all data reachable through Customer Interaction History. Impacts are limited to confidentiality (CVSS 3.1 base 7.7; C:H/I:N/A:N), so integrity and availability are not directly affected. No public proof of concept exists, the flaw is not on the CISA KEV list, and no exploitation in the wild is known.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-83166 to all Oracle E-Business Suite 12.2.3-12.2.15 environments. Restrict HTTP access to EBS web tiers (self-service/CRM pages) to trusted networks or VPN rather than exposing them to the internet, and enforce least-privilege on internal application accounts since exploitation requires only a low-privileged login. Review audit and access logs around the Customer Interaction History Outcome-Result component for anomalous data retrieval by low-privileged users.