CVE-2026-83436

Oracle Depot Repair within Oracle E-Business Suite contains a flaw in its Recall Management component, tracked as CVE-2026-83436, affecting releases 12.2.3 through 12.2.15. The vulnerability is easily exploitable by a low-privileged (already authenticated) attacker who can reach the E-Business Suite instance over HTTP. A successful attack gives the attacker unauthorized read access to critical — potentially all — Oracle Depot Repair accessible data, and the unauthorized ability to cause a partial denial of service against the module; integrity is not impacted (CVSS 3.1 base score 7.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L). Organizations running affected E-Business Suite releases with the Depot Repair product are exposed, particularly if broad internal or remote user populations have HTTP access to the environment. A fix was issued via Oracle's Critical Patch Update process; no public proof-of-concept is known, the issue is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported.

What to do: Apply the Oracle Critical Patch Update remediation for CVE-2026-83436 to all E-Business Suite environments on 12.2.3–12.2.15 running Depot Repair, following the relevant Patch Availability Document in My Oracle Support. Restrict HTTP access to E-Business Suite to trusted networks and users, and verify that low-privilege internal accounts cannot reach Depot Repair's Recall Management functions unless required. Review audit and access logs for unusual data reads by low-privileged accounts against Depot Repair data.