CVE-2026-83484

CVE-2026-83484 is a vulnerability in the Internal Operations component of Oracle US Federal Human Resources, a product within Oracle E-Business Suite, affecting releases 12.2.3 through 12.2.15. It is easily exploitable by a low-privileged (authenticated) attacker with network access via HTTP, requiring no user interaction. A successful attack allows the attacker to create, delete, or modify critical data — or all data accessible through Oracle US Federal Human Resources — and to read a subset of that data, with high impact to integrity and low impact to confidentiality (CVSS 3.1 base score 7.1). Organizations running the affected EBS 12.2 releases with the US Federal HR product deployed, primarily U.S. federal HR deployments, are at risk of unauthorized changes to sensitive personnel and payroll-related records. There is no known public proof of concept and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, so exploitation appears limited at this time.

What to do: Apply Oracle's latest Critical Patch Update for Oracle E-Business Suite 12.2 to remediate this flaw in the US Federal Human Resources Internal Operations component. Until patched, restrict HTTP access to the EBS application tier to trusted networks and VPNs, and enforce least-privilege role assignments for low-privileged accounts. Review audit logs for unexpected creation, modification, or deletion of Federal HR data by low-privilege users to rule out prior abuse.