CVE-2026-83170

CVE-2026-83170 is a high-severity (CVSS 8.0) vulnerability in the Documents component of Oracle One-to-One Fulfillment, a product within Oracle E-Business Suite. It is exploited by a low-privileged attacker who already has access to the network segment attached to the server running the product, allowing them to fully compromise the One-to-One Fulfillment installation. A successful attack results in complete takeover of the component, with high impact on confidentiality, integrity, and availability. All supported versions from 12.2.3 through 12.2.15 are affected. No public proof of concept is known and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, so exploitation in the wild is not currently evidenced.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-83170 to all Oracle E-Business Suite 12.2.3-12.2.15 environments running One-to-One Fulfillment. Because exploitation requires adjacent-network access plus a low-privileged account, enforce strict network segmentation around EBS application/database tiers and audit low-privileged EBS user accounts for signs of misuse. Verify that internal monitoring covers the One-to-One Fulfillment Documents component for anomalous activity.