CVE-2026-83194

A high-severity vulnerability (CVSS 3.1: 8.8) in the Internal Operations component of Oracle Depot Repair, part of Oracle E-Business Suite, allows a low-privileged attacker with network access via HTTP to fully compromise the Depot Repair module. The flaw is rated easily exploitable: it requires only an authenticated low-privilege account and no user interaction, and successful attacks result in a complete takeover with high impact on confidentiality, integrity, and availability of the affected module. Supported versions 12.2.10 through 12.2.15 are affected, meaning most current Release 12.2 deployments running this module are exposed. The low privilege requirement means compromised or insider credentials for any basic EBS account could be leveraged to pivot into Depot Repair. There is no known public PoC, no confirmed in-the-wild exploitation, and the CVE is not on the CISA Known Exploited Vulnerabilities catalog.

What to do: Apply the Oracle Critical Patch Update that addresses this CVE for Oracle Depot Repair; all supported versions 12.2.10-12.2.15 are affected, so patch rather than relying on version drift. Until patched, restrict HTTP access to EBS and Depot Repair endpoints via VPN/IP allowlisting and enforce least-privilege on EBS user accounts. Review EBS audit and access logs for anomalous activity by low-privileged accounts against Depot Repair Internal Operations functions.