CVE-2026-83432

CVE-2026-83432 is a vulnerability in the Estimate and Actual Charges component of Oracle Depot Repair, a module of Oracle E-Business Suite, affecting supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP — meaning any authenticated EBS user with minimal permissions — can easily exploit the flaw to compromise Oracle Depot Repair. A successful attack yields unauthorized creation, deletion, or modification of critical data, plus unauthorized read access to critical data or all Oracle Depot Repair accessible data, giving high confidentiality and integrity impact (CVSS 3.1 base score 8.1) with no availability impact. Organizations running EBS 12.2 with the Depot Repair module deployed are affected. No public proof of concept exists and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating no known in-the-wild exploitation to date.

What to do: Apply the Oracle Critical Patch Update that remediated this CVE to all EBS 12.2.3-12.2.15 environments running Depot Repair. Restrict HTTP access to EBS to trusted networks or VPN rather than exposing it to the internet, and review low-privileged account permissions for least-privilege enforcement. Audit Depot Repair logs for anomalous changes or reads of Estimate and Actual Charges data to rule out prior compromise.