CVE-2026-83447

CVE-2026-83447 is a high-severity (CVSS 3.1: 8.1) flaw in the Internal Operations component of Oracle Bills of Material, part of Oracle E-Business Suite releases 12.2.3 through 12.2.15. It is easily exploitable over the network via HTTP by an authenticated attacker holding only low-privileged access, requiring no user interaction. A successful attack yields unauthorized creation, deletion, or modification of critical Bills of Material data — or all data accessible through the product — as well as unauthorized read access to that data, though availability is not impacted. Organizations running the affected 12.2.3-12.2.15 releases with HTTP-reachable EBS instances and low-privilege user populations are exposed to silent data tampering and theft. There is no known public proof-of-concept, the CVE is not in the CISA KEV catalog, and no in-the-wild exploitation has been reported.

What to do: Apply the Oracle Critical Patch Update (CPU) containing the fix for CVE-2026-83447 to all E-Business Suite environments running Bills of Material 12.2.3-12.2.15, per the patch availability notes in the advisory. Restrict HTTP access to EBS application tiers to trusted networks or VPN, and enforce least-privilege EBS responsibilities for low-privileged accounts. Review Bills of Material change logs and audit records for unauthorized data creation, modification, or deletion by low-privileged users.