CVE-2026-83429

CVE-2026-83429 is a high-severity vulnerability in the Internal Operations component of Oracle Demand Signal Repository, a product within Oracle E-Business Suite. It is easily exploitable by a low-privileged (authenticated) attacker with network access via HTTP, requiring no user interaction. A successful attack lets the attacker create, delete, or modify critical data — or all data accessible to Demand Signal Repository — as well as read that data, compromising both its confidentiality and integrity (CVSS 3.1: 8.1). Affected deployments are Oracle E-Business Suite environments running Demand Signal Repository versions 12.2.3 through 12.2.15. No public proof of concept exists and the flaw is not in the CISA Known Exploited Vulnerabilities catalog, so no exploitation has been observed in the wild.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83429 to all Demand Signal Repository instances on versions 12.2.3-12.2.15. Until patched, restrict HTTP access to EBS/DSR endpoints (VPN or IP allowlisting) and audit low-privileged EBS accounts with Demand Signal Repository responsibilities for excess grants. Review DSR data-change logs for unauthorized creation, modification, or deletion activity.