CVE-2026-83328

CVE-2026-83328 is a vulnerability in the Personalization component of the Oracle Applications Framework within Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.15. It is exploitable over the network via HTTP by an attacker who already holds high-privileged (administrative-level) access to the EBS environment. Successful exploitation allows the attacker to fully compromise Oracle Applications Framework, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 7.2). Because exploitation requires elevated privileges, it primarily enables privilege escalation or persistence by insiders, compromised admin accounts, or attackers who have already breached initial authentication. The flaw is not listed in CISA's Known Exploited Vulnerabilities catalog and no public proof of concept is known, so there is no evidence of in-the-wild exploitation at this time.

What to do: Apply the Oracle Critical Patch Update that addresses this CVE to all Oracle E-Business Suite 12.2.3-12.2.15 environments as soon as possible. Audit and minimize accounts with high-privileged EBS responsibilities (especially those able to use Personalization), enforce strong authentication and monitor those accounts for anomalous activity, and verify that EBS is not directly exposed to the internet.