CVE-2026-83437

CVE-2026-83437 is a high-severity information disclosure flaw in the Change Management component of Oracle Engineering, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It is easily exploitable by a low-privileged, authenticated attacker with network access over HTTP, and because the vulnerability changes scope, a successful attack can also impact data beyond Oracle Engineering itself. The impact is confidentiality only: unauthorized access to critical data or complete access to all data reachable through Oracle Engineering (CVSS 3.1: 7.7, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). Affected organizations are those running the affected 12.2.3-12.2.15 releases, particularly deployments that expose EBS HTTP endpoints to broader networks. No public proof of concept is known and the flaw is not on the CISA KEV catalog, so exploitation in the wild is not currently evidenced.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-83437 to all E-Business Suite 12.2.3-12.2.15 environments, prioritizing instances reachable over HTTP. Review audit and access logs for low-privilege accounts that queried or exported Engineering/Change Management data or data outside that module (scope change). Restrict network access to EBS web endpoints and enforce least-privilege roles for accounts that can reach the Change Management functionality.