CVE-2026-83205

The Personalization component of Oracle Applications Framework in Oracle E-Business Suite contains an easily exploitable vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the framework. Successful attacks result in complete takeover of Oracle Applications Framework, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 8.8). All supported releases of Oracle E-Business Suite 12.2 from 12.2.3 through 12.2.15 are affected. No public proof-of-concept code exists, the flaw is not on the CISA Known Exploited Vulnerabilities list, and no in-the-wild exploitation has been reported, but the low privilege requirement means any valid low-level account is sufficient to attempt exploitation.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-83205 to all Oracle Applications Framework instances running E-Business Suite 12.2.3–12.2.15, referencing My Oracle Support for the specific patch. Restrict HTTP access to EBS application tiers using a VPN, reverse proxy, or IP allow-listing to reduce internet-facing exposure. Review audit and access logs for anomalous activity by low-privileged accounts targeting personalization functionality.