CVE-2026-83329

CVE-2026-83329 is a high-severity (CVSS 3.1: 8.8) vulnerability in the Personalization component of the Oracle Applications Framework (OAF) within Oracle E-Business Suite, affecting releases 12.2.9 through 12.2.15. It is easily exploitable by a low-privileged (authenticated) attacker who has network access to the EBS web tier via HTTP, requiring no user interaction. A successful attack allows the attacker to compromise Oracle Applications Framework entirely, with high impact on confidentiality, integrity, and availability — effectively a takeover of the framework layer of the EBS instance. Organizations running the affected 12.2.x releases with web-facing or broadly reachable HTTP endpoints are most at risk. The flaw is not currently listed in CISA's KEV catalog and no public proof-of-concept is known, so there is no evidence of in-the-wild exploitation at this time.

What to do: Apply the Oracle Critical Patch Update that resolves CVE-2026-83329 to all EBS 12.2.9-12.2.15 environments, prioritizing instances reachable over HTTP. Restrict external access to EBS web tiers (VPN/IP allowlisting) and require strong authentication for low-privileged self-service accounts. Review OAF Personalization definitions and audit logs for unauthorized modifications or suspicious activity by low-privilege users.