CVE-2026-83184

CVE-2026-83184 is a difficult-to-exploit, unauthenticated vulnerability in the Core component of the Oracle Application Object Library, part of Oracle E-Business Suite, affecting releases 12.2.3 through 12.2.15. An unauthenticated attacker who can reach the EBS instance over HTTP (network access) could exploit the flaw, and successful attacks allow unauthorized creation, deletion, or modification of critical data as well as unauthorized read access to critical data or all Application Object Library-accessible data. The vulnerability carries a CVSS 3.1 base score of 7.4 with high confidentiality and integrity impact but no availability impact, and the high attack-complexity rating suggests exploitation requires favorable conditions or significant attacker effort. Organizations running the affected EBS 12.2 releases and exposing HTTP endpoints to untrusted networks are the population at risk. There is no known public proof-of-concept and the flaw is not on the CISA Known Exploited Vulnerabilities catalog, so exploitation status is currently none known.

What to do: Apply the Oracle Critical Patch Update that resolves this CVE to all Oracle E-Business Suite 12.2.3-12.2.15 environments, prioritizing instances reachable over HTTP. Restrict external HTTP access to EBS application tiers via firewall rules or VPN so unauthenticated network attackers cannot reach the Application Object Library endpoints. Review application and database audit logs for unexpected data creation, deletion, or modification activity attributable to unauthenticated sessions.