CVE-2026-83188

CVE-2026-83188 is a vulnerability in the Internal Operations component of Oracle Depot Repair, a product within Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.15. It is exploited over the network via HTTP by an attacker who already holds high privileges in the environment, and successful attacks allow a complete takeover of Oracle Depot Repair with high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 7.2). In practice this is an escalation/pivot issue: a compromised or malicious privileged account (for example an internal operator or admin) can abuse the flaw to seize full control of the Depot Repair application, moving laterally within E-Business Suite data and workflows. Organizations running Oracle E-Business Suite 12.2.3-12.2.15 with the Depot Repair module licensed or installed are affected. No public proof-of-concept is known, the flaw is not on the CISA KEV list, and no in-the-wild exploitation has been reported as of this analysis.

What to do: Apply the Oracle Critical Patch Update that delivers the fix for CVE-2026-83188 to Oracle Depot Repair on all E-Business Suite 12.2.3-12.2.15 environments, and verify none of your instances remain in the affected range. Restrict HTTP access to EBS/Depot Repair endpoints so only trusted networks and VPN users can reach them, and enforce least-privilege for the high-privilege accounts that could exploit this flaw. Review audit logs for unusual activity by privileged internal-operations accounts on Depot Repair.