CVE-2026-83187

CVE-2026-83187 is a high-severity (CVSS 7.1) flaw in the Applications Calendar component of Oracle Common Applications Calendar within Oracle E-Business Suite, affecting supported versions 12.2.3 through 12.2.15. A remote attacker with only low-privileged (valid but unprivileged) credentials can exploit it over HTTP with no user interaction or special conditions, making it easily exploitable. A successful attack lets the attacker create, delete, or modify critical data or all data accessible through the Applications Calendar, and read a subset of that data, with high integrity impact and low confidentiality impact. Organizations running affected E-Business Suite 12.2 releases who expose calendar functionality to a broad internal or external user base are at risk. There is no evidence of exploitation in the wild and no public proof of concept, and the issue is not on the CISA KEV list, but it was fixed in Oracle's Critical Patch Update cycle and should be treated as a routine-but-priority patch.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-83187 to all E-Business Suite 12.2.3-12.2.15 environments, prioritizing instances reachable over the network. Restrict HTTP access to EBS so only authenticated, authorized users and trusted networks can reach Applications Calendar pages, and enforce least-privilege account roles. Review calendar records for unexplained creation, deletion, or modification and audit low-privileged accounts for anomalous activity.