CVE-2026-83449

A vulnerability in the Internal Operations component of Oracle Bills of Material, part of Oracle E-Business Suite, allows a low-privileged attacker with network access via HTTP to easily compromise the product. The vector carries a scope change, meaning successful attacks may significantly impact additional Oracle E-Business Suite products beyond Bills of Material itself. An attacker who succeeds gains unauthorized access to critical data or complete access to all Oracle Bills of Material-accessible data, as well as the unauthorized ability to cause a partial denial of service. Affected deployments are Oracle E-Business Suite releases 12.2.3 through 12.2.15 (CVSS 3.1 base score 8.5, high). No public proof of concept exists, there is no confirmed in-the-wild exploitation, and the CVE is not on the CISA Known Exploited Vulnerabilities list.

What to do: Apply the Oracle Critical Patch Update containing the fix for CVE-2026-83449 to every Oracle E-Business Suite 12.2.3-12.2.15 environment as soon as it is available. Until patched, restrict HTTP access to EBS to trusted networks or VPN, audit and minimize low-privileged EBS account grants, and monitor logs for anomalous access to Bills of Material functions, unusual data retrieval, or degradation suggestive of partial denial of service.