CVE-2026-83448

CVE-2026-83448 is a vulnerability in the Internal Operations component of Oracle Bills of Material, part of Oracle E-Business Suite, affecting releases 12.2.3 through 12.2.15. It is easily exploitable by a low-privileged (authenticated) attacker with network access via HTTP, who can send crafted requests to compromise the Bills of Material module. A successful attack yields unauthorized creation, deletion, or modification of critical data — or all data accessible through Oracle Bills of Material — as well as unauthorized read access to that data, with high impact to both confidentiality and integrity (CVSS 3.1 base score 8.1; availability is not affected). Organizations running affected 12.2.x releases with the manufacturing/BOM module exposed to users over HTTP are at risk. No public proof-of-concept or confirmed in-the-wild exploitation is known, and the flaw is not on the CISA KEV catalog.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83448 to all EBS 12.2.3-12.2.15 environments. Restrict HTTP access to EBS so only trusted networks/VPN users can reach it, and audit least-privilege roles since exploitation requires only a low-privileged account. Review Bills of Material data for unauthorized creation, modification, or deletion and monitor for anomalous access by low-privilege users.