CVE-2026-83172

CVE-2026-83172 is a high-severity (CVSS 3.1: 8.5) vulnerability in the OSO Other component of Oracle Sales Online, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15. A remote attacker holding only low-privileged (valid, unprivileged) credentials can trigger the flaw over HTTP, and because the vulnerability changes scope, the impact can extend beyond Oracle Sales Online into additional products on the EBS stack. Successful attacks can yield unauthorized read access to critical data or complete access to all Oracle Sales Online-accessible data, as well as unauthorized insert, update, or delete access to some of that data; availability is not impacted. Organizations running affected EBS 12.2 releases with Oracle Sales Online enabled are at risk, particularly where the EBS web tier is reachable from untrusted networks. No public proof of concept exists, the flaw is not on the CISA Known Exploited Vulnerabilities list, and no exploitation in the wild has been reported.

What to do: Apply the Oracle Critical Patch Update remediation for CVE-2026-83172 to all EBS environments on 12.2.3-12.2.15 that have Oracle Sales Online installed. Until patched, restrict HTTP access to the EBS web tier to trusted networks or VPN, review and minimize low-privileged OSO responsibilities, and audit application logs for anomalous cross-module data reads or unexpected inserts/updates/deletes by low-privilege accounts.