CVE-2026-83300

CVE-2026-83300 is a high-severity (CVSS 7.1) vulnerability in the Install component of Oracle XML Gateway, part of Oracle E-Business Suite releases 12.2.3 through 12.2.15. It is exploited over the network via HTTP by an attacker who already holds a low-privileged account on the EBS instance, requiring no user interaction and no special conditions. A successful attack lets the attacker read critical data or all data accessible to Oracle XML Gateway and to cause a partial denial of service of the XML Gateway component; confidentiality and availability are impacted, but integrity is not. Any organization running an affected E-Business Suite 12.2.x release with the XML Gateway component installed is affected, particularly instances with HTTP endpoints reachable by ordinary users or the internet. There is no known public proof of concept and the CVE is not on the CISA Known Exploited Vulnerabilities catalog, so exploitation is not currently observed in the wild.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83300 to all Oracle E-Business Suite 12.2.3-12.2.15 environments running Oracle XML Gateway, and confirm the XML Gateway Install component patch was applied. Restrict HTTP access to EBS so only authenticated, necessary users can reach XML Gateway endpoints, and enforce least-privilege for low-privileged accounts since exploitation requires valid credentials. Review audit and access logs for anomalous data access or partial service disruption tied to XML Gateway by low-privileged users.