CVE-2026-83332

Oracle E-Business Suite's Oracle Applications Framework (OAF), specifically the Personalization component, contains an easily exploitable vulnerability in versions 12.2.9 through 12.2.15. A low-privileged, authenticated attacker with network access via HTTP can trigger the flaw to compromise the Applications Framework. A successful attack yields unauthorized read access to critical data — or complete access to all OAF-accessible data — as well as unauthorized update, insert, and delete access to some OAF-accessible data. Organizations running affected E-Business Suite 12.2 releases with the framework reachable over HTTP/HTTPS are exposed, particularly if self-service or partner accounts exist. No public proof-of-concept is known and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog, so exploitation is not currently observed.

What to do: Apply the Oracle Critical Patch Update that addresses this vulnerability to all Oracle E-Business Suite 12.2.9-12.2.15 environments, as Oracle patches OAF via its CPU cycle rather than standalone version bumps. Restrict HTTP/HTTPS access to OAF pages at the perimeter (VPN/IP allow-listing) and audit low-privilege account permissions to reduce the pool of usable credentials. Review Personalization and application audit logs for anomalous bulk reads or unauthorized data modification by low-privileged accounts.