CVE-2026-83204

CVE-2026-83204 is a difficult-to-exploit vulnerability in the Internal Operations component of Oracle Sourcing, a module of Oracle E-Business Suite, affecting releases 12.2.3 through 12.2.15. It is triggered over HTTP by an authenticated attacker holding only low-privileged access to the EBS instance, so it does not expose systems to anonymous internet attackers by itself. A successful attack allows the attacker to fully compromise Oracle Sourcing, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 7.5). The high attack complexity means reliable exploitation is non-trivial, and exploitation likely requires chaining with weak account credentials or an existing foothold. There is no known public proof-of-concept, the flaw is not on the CISA KEV list, and no in-the-wild exploitation has been reported; it was disclosed and patched by Oracle through its Critical Patch Update process.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-83204 to all E-Business Suite 12.2.3-12.2.15 environments running Sourcing, since Oracle patches are cumulative and no workaround is typically offered. Review Sourcing and Internal Operations audit logs for anomalous activity by low-privileged accounts, and audit those accounts for weak or dormant credentials. Restrict HTTP access to EBS self-service and Sourcing URLs via network controls (VPN/IP allow-listing) to shrink the attack surface for authenticated abuse.