CVE-2026-83479

CVE-2026-83479 is a high-severity (CVSS 8.8) vulnerability in the Oracle Contracts product of Oracle E-Business Suite, in the Internal Operations component, affecting supported versions 12.2.14 through 12.2.15. It is easily exploitable by a low-privileged attacker who has network access to the E-Business Suite over HTTP, requiring only a valid low-privilege account and no user interaction. A successful attack allows the attacker to fully compromise Oracle Contracts, with high impact on the confidentiality, integrity, and availability of the affected module's data and functions. Organizations running E-Business Suite 12.2.14 or 12.2.15 with the Oracle Contracts product exposed to users or networks are affected. There is no evidence of in-the-wild exploitation, and no public proof-of-concept is known at this time.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83479 to all E-Business Suite 12.2.14 and 12.2.15 environments running Oracle Contracts. Restrict HTTP access to EBS to trusted networks/VPN and enforce least-privilege on EBS user accounts, since exploitation requires only a low-privileged login. Review Oracle Contracts audit logs and Internal Operations activity for anomalous actions by low-privilege accounts as an indicator of compromise.