CVE-2026-83152: Oracle Project Intelligence Auth Bypass

CVE-2026-83152 Overview

CVE-2026-83152 is a high-severity vulnerability in the Oracle Project Intelligence product of Oracle E-Business Suite, affecting the Internal Operations component. Supported versions 12.2.3 through 12.2.15 are impacted. A low-privileged attacker with network access via HTTP can exploit the flaw to compromise Oracle Project Intelligence. Successful exploitation permits unauthorized creation, deletion, or modification of critical data, and unauthorized read access to all data accessible to the product. Oracle addressed the issue in Security Alert CSPUSEP2026.

Critical Impact
Authenticated network attackers can read and modify all data accessible to Oracle Project Intelligence, undermining confidentiality and integrity of business project records.

Affected Products

Oracle E-Business Suite — Oracle Project Intelligence 12.2.3
Oracle E-Business Suite — Oracle Project Intelligence versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Project Intelligence 12.2.15

Discovery Timeline

2026-09-15 - CVE-2026-83152 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-83152

Vulnerability Analysis

The flaw resides in the Internal Operations component of Oracle Project Intelligence, part of Oracle E-Business Suite. An authenticated attacker holding low-privilege application credentials can send crafted HTTP requests to reachable endpoints and interact with data outside the intended authorization scope. Oracle's advisory characterizes the issue as easily exploitable, requiring no user interaction and no elevated privileges beyond a standard application account.

Exploitation yields both read and write access to data managed by Oracle Project Intelligence. That scope covers project records, financial project metrics, resource information, and related internal operations data used for enterprise reporting. Availability is not impacted, but the integrity exposure allows attackers to alter, insert, or remove records that downstream business processes and reports depend on.

Oracle has not published detailed root-cause information. Based on the advisory metadata, the class of issue is consistent with broken access control (missing or improper authorization checks) on HTTP-accessible functions in the Internal Operations component.

Root Cause

Oracle's Security Alert CSPUSEP2026 does not disclose implementation-level detail. The impact profile — full read and write access with only low privileges required — points to authorization enforcement gaps in HTTP-exposed handlers of the Internal Operations component. No CWE has been assigned to the record.

Attack Vector

The attack vector is network-based over HTTP against an Oracle E-Business Suite deployment exposing Oracle Project Intelligence. The attacker must hold a valid low-privileged application account. No user interaction is required, and the scope is unchanged, meaning the impact stays within the vulnerable component's data boundary.

No verified public exploit code is available for CVE-2026-83152. See the Oracle Security Alert CSPUSEP2026 for vendor guidance and patch references.

Detection Methods for CVE-2026-83152

Indicators of Compromise

Unexpected create, update, or delete operations on Oracle Project Intelligence records performed by low-privileged application accounts.
HTTP requests to Internal Operations endpoints originating from user sessions that historically only performed read operations.
Unusual bulk export activity or sequential record enumeration in Project Intelligence audit logs.

Detection Strategies

Enable and centralize Oracle E-Business Suite Sign-On Audit and Page Access Tracking, then alert on access to Internal Operations pages by accounts lacking a business justification.
Review FND_LOGINS and FND_UNSUCCESSFUL_LOGINS for anomalous session patterns preceding data modification events in Project Intelligence tables.
Baseline expected HTTP request paths and parameters per role, then flag deviations targeting Project Intelligence servlets.

Monitoring Recommendations

Forward Oracle E-Business Suite application, database, and web-tier logs into a SIEM for correlation across the request, authentication, and data-change layers.
Monitor privileged and low-privileged account activity for lateral access into Project Intelligence functions outside their assigned responsibilities.
Track EPSS scoring for CVE-2026-83152, currently 0.365% at the 30.14 percentile, and re-evaluate exposure if exploit activity increases.

How to Mitigate CVE-2026-83152

Immediate Actions Required

Apply the fixes referenced in Oracle Security Alert CSPUSEP2026 to all Oracle E-Business Suite environments running Project Intelligence versions 12.2.3 through 12.2.15.
Inventory Oracle E-Business Suite instances exposed to internal or external HTTP access and prioritize patching of internet-reachable deployments.
Audit application accounts with access to Project Intelligence and revoke unnecessary privileges pending remediation.

Patch Information

Oracle released fixes as part of Security Alert CSPUSEP2026. Administrators should follow Oracle's advisory to identify the correct patch for each affected E-Business Suite release and apply it through the standard AD/TXK patching workflow. Validate the fix in a non-production environment before rolling it into production instances.

Workarounds

Restrict network access to Oracle E-Business Suite web tiers using firewall rules, VPN gating, or reverse-proxy allowlists until patches are applied.
Temporarily disable or restrict responsibilities that grant access to the Project Intelligence Internal Operations component for accounts that do not require it.
Increase audit logging on Project Intelligence pages and enforce short session lifetimes to reduce the window for abuse.