CVE-2026-83477

CVE-2026-83477 is a high-severity (CVSS 3.1: 8.1) flaw in the Workbenches component of Oracle Work in Process, part of Oracle E-Business Suite releases 12.2.3 through 12.2.15. It is easily exploitable by an unauthenticated attacker who has access to the physical network segment attached to the hardware where the product executes (attack vector: adjacent network, so remote internet-wide exploitation is not the primary risk). A successful attack allows unauthorized creation, deletion, or modification of critical data — or all Oracle Work in Process accessible data — as well as unauthorized read access to that data, with high impact on confidentiality and integrity but no impact on availability. Organizations running affected E-Business Suite 12.2.x releases with the Work in Process manufacturing module deployed are exposed, particularly where internal network segments are loosely restricted. No public proof-of-concept exists and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, so exploitation status is none known.

What to do: Apply the Oracle Critical Patch Update that remediated CVE-2026-83477 to all E-Business Suite 12.2.3-12.2.15 environments running Work in Process, prioritizing the WIP Workbenches component. Restrict access to the network segments hosting the EBS application and database tiers via VLAN segmentation and firewall rules so that only trusted hosts can reach them, since exploitation requires adjacent-network access. Review audit logs and WIP transactional data for unexplained creation, modification, or deletion activity dating back to before the patch was applied.