CVE-2026-83161: Oracle Project Intelligence Auth Bypass Flaw

CVE-2026-83161 Overview

CVE-2026-83161 is an access control vulnerability [CWE-284] in the Oracle Project Intelligence component of Oracle E-Business Suite. The flaw resides in the Internal Operations component and affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit the weakness without user interaction. Successful exploitation allows unauthorized creation, modification, or deletion of critical Oracle Project Intelligence data, plus read access to a subset of accessible data.

Critical Impact
Authenticated attackers can tamper with all Oracle Project Intelligence data across affected E-Business Suite deployments, undermining project financial and operational integrity.

Affected Products

Oracle E-Business Suite 12.2.3 through 12.2.15
Oracle Project Intelligence (Internal Operations component)
Deployments exposing Oracle Project Intelligence over HTTP

Discovery Timeline

2026-09-15 - CVE-2026-83161 published to the National Vulnerability Database (NVD)
2026-09-17 - Last updated in the NVD database

Technical Details for CVE-2026-83161

Vulnerability Analysis

The vulnerability originates in the Internal Operations component of Oracle Project Intelligence, part of Oracle E-Business Suite. Improper access control [CWE-284] allows authenticated users to perform actions beyond their assigned authorization scope. An attacker with valid low-privileged credentials can send crafted HTTP requests to interact with data they should not reach.

The scope remains unchanged, meaning the impact is confined to Oracle Project Intelligence. However, the integrity impact is high because attackers can create, delete, or modify all accessible data. Confidentiality impact is limited to a subset of readable data, and availability is not affected.

Root Cause

The root cause is missing or improperly enforced authorization checks on Internal Operations functionality within Oracle Project Intelligence. The application trusts the caller's session for privileged data operations without verifying entitlement at the resource level. This aligns with the Broken Access Control pattern captured under [CWE-284].

Attack Vector

Exploitation requires only network reachability to the Oracle E-Business Suite HTTP interface and valid low-privileged credentials. No user interaction is required and attack complexity is low. The attacker issues HTTP requests to Project Intelligence endpoints that fail to enforce object-level or function-level authorization, then reads sensitive fields or writes arbitrary values to project data. Refer to the Oracle Security Advisory for vendor-supplied technical details.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.318%.

Detection Methods for CVE-2026-83161

Indicators of Compromise

Unexpected create, update, or delete operations against Oracle Project Intelligence tables performed by low-privileged accounts.
HTTP requests from standard user sessions targeting Internal Operations endpoints not typically used by that role.
Anomalous spikes in Project Intelligence write activity outside normal business processes.

Detection Strategies

Enable Oracle E-Business Suite audit trails on Project Intelligence tables to record row-level changes with the acting user.
Correlate application audit logs with web tier access logs to attribute HTTP requests to specific user sessions and endpoints.
Baseline expected access patterns per role and alert on deviations, particularly write operations from read-only personas.

Monitoring Recommendations

Forward E-Business Suite application, database, and web tier logs to a centralized analytics platform for cross-source correlation.
Monitor authentication events for low-privileged accounts exhibiting unusual query volume against Project Intelligence.
Alert on modifications to project financial or operational data performed outside change-management windows.

How to Mitigate CVE-2026-83161

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Advisory to affected E-Business Suite environments.
Inventory all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15 and prioritize internet-exposed systems.
Review recent audit logs for anomalous Project Intelligence activity from low-privileged accounts.

Patch Information

Oracle addresses this vulnerability in the Critical Patch Update documented in the Oracle Security Advisory. Administrators should apply the fix to all affected Oracle E-Business Suite deployments in the 12.2.3–12.2.15 range following Oracle's standard patching procedures and validate the update in a non-production environment first.

Workarounds

Restrict network access to Oracle E-Business Suite HTTP endpoints using firewalls, reverse proxies, or VPN gating.
Review and tighten role definitions in Oracle Project Intelligence to enforce least privilege for Internal Operations functions.
Increase logging verbosity on Project Intelligence endpoints and monitor for suspicious activity until patching is complete.

bash

# Configuration example
# Refer to the Oracle Security Advisory for vendor-provided patch guidance:
# https://www.oracle.com/security-alerts/cspusep2026.html