CVE-2026-83189

CVE-2026-83189 is a high-severity (CVSS 8.8) vulnerability in the Oracle User Management product of Oracle E-Business Suite, specifically in the Proxy User Delegation component. An attacker with only a low-privileged account and HTTP network access to the EBS instance can easily exploit the flaw to fully compromise Oracle User Management, gaining high-impact control over confidentiality, integrity, and availability of the component. Any organization running affected EBS releases 12.2.3 through 12.2.15 is exposed, particularly if the suite is reachable over the network by broad user populations. The issue was assigned by Oracle and is addressed through Oracle's Critical Patch Update process. No public proof-of-concept exists and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, so exploitation status is currently none known.

What to do: Apply the Oracle Critical Patch Update remediation for CVE-2026-83189 to all E-Business Suite 12.2.3-12.2.15 environments as soon as the corresponding CPU is available. Review proxy user delegation assignments, workflow roles, and audit logs for unexpected delegation grants or privilege changes made by low-privilege accounts. Restrict HTTP access to EBS via network segmentation and VPN, and audit low-privilege accounts for signs of abuse of the User Management self-service functions.