CVE-2026-83428

CVE-2026-83428 is a high-severity (CVSS 8.1) authorization flaw in the Internal Operations component of Oracle Demand Signal Repository (DSR), a product within Oracle E-Business Suite. A remote attacker who already holds a low-privileged account and can reach the application over HTTP can escalate within DSR to gain unauthorized ability to create, delete, or modify critical data — and to read critical data or all DSR-accessible data (high confidentiality and integrity impact; no availability impact). Affected deployments are Oracle E-Business Suite installations running DSR versions 12.2.3 through 12.2.15. The vulnerability is described as easily exploitable once low-privilege access is obtained, but there is no public proof of concept and no evidence of exploitation in the wild, and it is not on the CISA KEV list.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83428 to all Demand Signal Repository 12.2.3-12.2.15 environments. Restrict HTTP/HTTPS network access to EBS and DSR endpoints to trusted users and networks, and review DSR account privileges. Audit DSR data-change and access logs around the patch window for signs of unauthorized modification or reads by low-privilege accounts.