CVE-2026-83174

CVE-2026-83174 is a high-severity (CVSS 8.1) authorization flaw in the Application Framework component of Oracle CRM Technical Foundation, part of Oracle E-Business Suite releases 12.2.3 through 12.2.15. It is triggered remotely over HTTP by an attacker who already holds a low-privileged account, such as a self-service or basic employee login, needing no user interaction. A successful exploit lets the attacker create, delete, or modify critical CRM data, or read some or all CRM Technical Foundation data, without affecting availability. Any organization running an affected E-Business Suite 12.2 instance exposed to users over the network is at risk, with internet-facing deployments most exposed. No public proof-of-concept or in-the-wild exploitation is known, and the flaw is not on CISA's KEV list.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83174 to all E-Business Suite 12.2.3-12.2.15 environments, prioritizing any instance reachable over HTTP. Restrict EBS web endpoints to VPN or allow-listed networks and enforce least-privilege roles for low-privilege accounts. Review CRM data audit logs for unauthorized reads, changes, or deletions performed by low-privilege users as an indicator of prior abuse.