CVE-2026-83171

CVE-2026-83171 is a difficult-to-exploit flaw in the Documents component of Oracle One-to-One Fulfillment, a module of Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP who already holds valid credentials can trigger the flaw to gain unauthorized read access to critical data or complete access to all data reachable through Oracle One-to-One Fulfillment, and can cause a partial denial of service of the module. Because the vulnerability has a scope change (S:C), successful attacks may also significantly impact additional products beyond the One-to-One Fulfillment module itself. Integrity is not impacted per the CVSS vector, but the combination of high confidentiality impact and scope change yields a CVSS 3.1 base score of 7.1 (high). The vulnerability is not in the CISA KEV catalog, no public proof of concept is known, and there is no indication of in-the-wild exploitation.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83171 to all Oracle E-Business Suite 12.2.3-12.2.15 environments running the One-to-One Fulfillment component. Restrict HTTP access to EBS application tiers (VPNs, allowlists, WAF rules) since exploitation requires a network-accessible low-privilege account, and audit or prune unnecessary low-privilege application accounts. Review logs for unusual document access or availability issues on the One-to-One Fulfillment module, keeping in mind the scope change means adjacent products could be affected in a successful attack.