CVE-2026-83425

An access-control flaw in the Internal Operations component of Oracle Complex Maintenance, Repair and Overhaul (CMRO) lets a low-privileged attacker with network access via HTTP read data beyond their authorization. Successful attacks can result in unauthorized access to critical data or complete access to all CMRO-accessible data, plus a partial denial of service, and because of a scope change the impact can extend to additional products beyond CMRO itself. Deployments affected are Oracle E-Business Suite releases 12.2.12 through 12.2.15 running the CMRO product. No public proof of concept is known and the issue is not on the CISA Known Exploited Vulnerabilities catalog, so there is no confirmed in-the-wild exploitation.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83425 and move CMRO to a release later than 12.2.15 (or the corresponding patched bundle). Until patched, restrict HTTP reachability to EBS at the network/WAF layer and tightly audit low-privileged account provisioning, since the flaw only requires a low-privilege authenticated session. Review application and database audit logs for anomalous data reads by low-privilege users and for partial denial-of-service symptoms in CMRO.