CVE-2026-83159: Oracle E-Business Suite Privilege Escalation

CVE-2026-83159 Overview

CVE-2026-83159 affects the Applications DBA product within Oracle E-Business Suite, specifically the ADPatch component. The flaw impacts supported versions 12.2.3 through 12.2.15. An unauthenticated attacker with logon access to the infrastructure where Applications DBA executes can compromise the Applications DBA component. Successful exploitation requires human interaction from a user other than the attacker and can result in full takeover of Applications DBA, affecting confidentiality, integrity, and availability. The weakness is categorized as improper access control [CWE-284].

Critical Impact

Local attackers can achieve complete takeover of the Oracle Applications DBA component when a privileged user interacts with attacker-controlled input during patching operations.

Affected Products

• Oracle E-Business Suite Applications DBA 12.2.3
• Oracle E-Business Suite Applications DBA versions 12.2.4 through 12.2.14
• Oracle E-Business Suite Applications DBA 12.2.15

Discovery Timeline

• 2026-09-15 - CVE-2026-83159 published to NVD
• 2026-09-17 - Last updated in NVD database
• September 2026 - Addressed in Oracle Security Alert CSPU SEP 2026

Technical Details for CVE-2026-83159

Vulnerability Analysis

The vulnerability resides in the ADPatch component of the Applications DBA product shipped with Oracle E-Business Suite. ADPatch (AutoPatch) applies patches, maintenance packs, and family packs to E-Business Suite environments and runs with elevated privileges on the application tier. The flaw allows an attacker with local logon access to the infrastructure hosting Applications DBA to compromise the component when a legitimate operator initiates a patching workflow. Because the attack vector is local and requires user interaction, exploitation typically involves a lower-privileged infrastructure user staging malicious input that a DBA subsequently processes. Successful exploitation results in a complete loss of confidentiality, integrity, and availability of Applications DBA. The current EPSS probability is 0.133%.

Root Cause

The issue is classified under [CWE-284] Improper Access Control. Oracle's advisory does not publicly disclose the specific implementation detail, but the classification indicates that ADPatch does not sufficiently restrict access to a resource, control path, or execution context relied upon during patching.

Attack Vector

The attacker requires local logon to the infrastructure where Applications DBA runs but does not require authentication to the Applications DBA product itself. A second user, typically a DBA or operator, must perform an action such as launching a patch process. That interaction triggers the vulnerable code path and leads to takeover of the Applications DBA component. Refer to the Oracle Security Alert CSPU SEP 2026 for vendor-supplied technical detail.

Detection Methods for CVE-2026-83159

Indicators of Compromise

• Unexpected files, symbolic links, or scripts appearing in ADPatch staging directories or the $APPL_TOP patch workspace prior to a maintenance window.
• Execution of shell or SQL commands spawned by the adpatch process outside of documented patch payloads.
• Modifications to ADPatch driver files, environment scripts, or worker logs by non-privileged local accounts.

Detection Strategies

• Monitor process ancestry for adpatch child processes that invoke shells, compilers, or network utilities inconsistent with normal patching operations.
• Alert on writes to Applications DBA directories by user accounts that are not the designated applmgr owner.
• Correlate DBA logon sessions with subsequent privileged file creation events performed by other local users on the application tier host.

Monitoring Recommendations

• Enable filesystem auditing on the E-Business Suite application tier, including $APPL_TOP, $INST_TOP, and patch staging paths.
• Forward operating system audit logs and adpatch worker logs to a centralized platform for retention and correlation.
• Track all interactive and non-interactive logons to hosts running Applications DBA and baseline expected patching activity.

How to Mitigate CVE-2026-83159

Immediate Actions Required

• Apply the fixes documented in the Oracle Security Alert CSPU SEP 2026 to all Oracle E-Business Suite 12.2.3 through 12.2.15 environments.
• Restrict local logon access to application tier hosts to a minimal set of trusted administrators.
• Review and tighten filesystem permissions on ADPatch working directories and patch staging areas.

Patch Information

Oracle addressed CVE-2026-83159 in the Critical Security Patch Update advisory published September 2026. Administrators should consult the Oracle Security Alert CSPU SEP 2026 for patch identifiers and installation guidance specific to their E-Business Suite release. No public exploit or proof-of-concept has been reported at the time of writing.

Workarounds

• Limit shell access on Applications DBA hosts to accounts required for operational duties and remove shared local accounts.
• Require DBAs to validate the provenance of any files present in patch staging locations before invoking adpatch.
• Segment the application tier from general-purpose infrastructure to reduce the population of users capable of local logon.