CVE-2026-83430

CVE-2026-83430 is an easily exploitable authorization weakness in the Internal Operations component of Oracle Product Workbench, part of Oracle E-Business Suite releases 12.2.3 through 12.2.15. A remote attacker with network access via HTTP who already holds a low-privileged account on the E-Business Suite instance can exploit it to gain unauthorized creation, deletion, or modification rights over critical Product Workbench data, as well as unauthorized read access to that data. The flaw carries a CVSS 3.1 base score of 8.1 (high), with high confidentiality and integrity impact but no availability impact, and it requires no user interaction. Organizations running affected 12.2.x releases of E-Business Suite are exposed, particularly those whose application tiers are reachable over the network. No public proof-of-concept exists and the issue is not listed in CISA's Known Exploited Vulnerabilities catalog, so exploitation is not currently observed in the wild.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-83430 to all E-Business Suite 12.2.3–12.2.15 environments, and prioritize any instance whose HTTP endpoints are reachable beyond the internal network. Restrict access to the EBS application tier using IP allowlisting or VPN so only authenticated, authorized users can reach Product Workbench. Review audit trails for suspicious data creation, modification, or deletion by low-privilege accounts in Product Workbench, and tighten role assignments to enforce least privilege.