CVE-2026-83173

CVE-2026-83173 is a high-severity (CVSS 7.1) flaw in the Documents component of Oracle One-to-One Fulfillment, part of Oracle E-Business Suite. It is easily exploitable by a low-privileged (authenticated) attacker with network access over HTTP, requiring no user interaction. Successful exploitation gives the attacker unauthorized access to critical data — potentially complete access to all data reachable through One-to-One Fulfillment, which handles customer-facing documents such as correspondence and fulfillment content — and the ability to cause a partial denial of service of the product. All Oracle E-Business Suite 12.2.3 through 12.2.15 deployments running this module are affected. No public proof of concept or known in-the-wild exploitation has been reported, and the CVE is not on the CISA KEV list.

What to do: Apply the Oracle Critical Patch Update that addresses this CVE to all E-Business Suite 12.2.3-12.2.15 environments running One-to-One Fulfillment. Restrict HTTP access to EBS application tiers (ideally via VPN or allowlisting) and enforce least-privilege roles for accounts that can reach the module. Review audit logs for unusual document access or partial service disruption by low-privileged accounts to rule out prior exploitation.