CVE-2026-83435

A difficult-to-exploit vulnerability in the Internal Operations component of Oracle Bills of Material, part of Oracle E-Business Suite, allows a low-privileged authenticated attacker with HTTP network access to compromise the product. Successful attacks can result in unauthorized creation, deletion, or modification of critical data — up to full write access to all Bills of Material accessible data — as well as unauthorized read access to that data, and because the flaw carries a scope change, attacks may significantly impact additional Oracle E-Business Suite products beyond Bills of Material. The affected versions are Oracle E-Business Suite release 12.2 at patch levels 12.2.13 through 12.2.15. The CVSS 3.1 base score of 8.2 reflects high confidentiality and integrity impacts, though the high attack complexity and the requirement for valid low-privilege credentials lower practical exploitability. No public proof of concept is known, the flaw is not on the CISA KEV list, and there is no indication of exploitation in the wild.

What to do: Apply the Oracle Critical Patch Update containing the fix for CVE-2026-83435 to all EBS 12.2.13-12.2.15 environments. Restrict HTTP access to EBS and enforce least-privilege role assignments so low-privileged accounts cannot reach Bills of Material Internal Operations functionality. Review BOM data and audit logs for unauthorized creation, modification, or deletion attributed to low-privilege users.