CVE-2026-83179

CVE-2026-83179 is a difficult-to-exploit vulnerability in the Applications Calendar component of Oracle Common Applications Calendar within Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.15. A remote attacker with network access via HTTP who already holds a low-privileged account on the EBS instance can trigger the flaw to gain unauthorized ability to create, delete, or modify critical calendar data, read all data accessible to the calendar component, and cause a partial denial of service. Because exploitation requires valid low-privileged credentials and high attack complexity, the risk is concentrated in EBS deployments that expose HTTP endpoints to broad user populations or the internet. Oracle addressed the issue in its Critical Patch Update cycle, and organizations running affected 12.2.x releases should patch. There is no evidence of in-the-wild exploitation and no public proof of concept is known.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83179 to all E-Business Suite 12.2.3-12.2.15 environments, prioritizing instances whose HTTP endpoints are reachable beyond the internal network. Restrict EBS web tier exposure, enforce least-privilege on application accounts, and review calendar module audit and HTTP access logs for anomalous data changes or unauthorized reads by low-privileged users.