CVE-2026-83172: Oracle Sales Online Auth Bypass Vulnerability

CVE-2026-83172 Overview

CVE-2026-83172 affects the Oracle Sales Online product within Oracle E-Business Suite, specifically the OSO Other component. The vulnerability impacts supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit the flaw without user interaction. Successful exploitation allows unauthorized access to critical Oracle Sales Online data and unauthorized modification of a subset of that data. The scope changes on exploitation, meaning attacks may impact additional Oracle products beyond Sales Online itself.

Critical Impact
Low-privileged network attackers can compromise Oracle Sales Online, gain complete read access to accessible data, and modify a subset of records, with impact extending beyond the vulnerable component due to scope change.

Affected Products

Oracle E-Business Suite — Oracle Sales Online 12.2.3
Oracle E-Business Suite — Oracle Sales Online 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Sales Online 12.2.15

Discovery Timeline

2026-09-15 - CVE-2026-83172 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-83172

Vulnerability Analysis

The vulnerability resides in the OSO Other component of Oracle Sales Online, a customer-facing sales module of Oracle E-Business Suite. Oracle classifies exploitation as easily achievable over HTTP, requiring only a low-privileged authenticated session. Because the vulnerability triggers a scope change, an attacker can affect resources managed outside the vulnerable component's security authority. The impact profile emphasizes confidentiality, with high impact to data readable through Sales Online, and lower-order impact to integrity through unauthorized insert, update, or delete operations. Availability is not directly affected.

Root Cause

Oracle has not published detailed root cause information for CVE-2026-83172. The Oracle Security Alert CSPUSEP2026 documents the issue as a network-exploitable flaw in the Oracle Sales Online HTTP-exposed interface. The scope change indicates that the vulnerable code path executes in a context capable of acting on data or components managed by a different security authority within E-Business Suite.

Attack Vector

Exploitation occurs over the network via HTTP against an internet- or intranet-reachable Oracle E-Business Suite deployment. The attacker must hold a valid low-privileged account on the target Sales Online instance. No user interaction is required, and the attack complexity is low. See the Oracle Security Alert CSPUSEP2026 for the vendor description.

No public proof-of-concept exploit code is available for CVE-2026-83172. The vulnerability mechanism is described in prose only, based on Oracle's advisory.

Detection Methods for CVE-2026-83172

Indicators of Compromise

Unexpected HTTP requests to Oracle Sales Online (OSO) endpoints originating from low-privileged user sessions targeting records outside their normal business scope.
Anomalous read volume against Sales Online data tables, including bulk enumeration of customer, opportunity, or lead records.
Unauthorized INSERT, UPDATE, or DELETE operations against Oracle Sales Online objects performed by accounts without a business need.

Detection Strategies

Correlate Oracle E-Business Suite application audit logs with web-tier HTTP access logs to identify low-privileged accounts issuing high-impact Sales Online requests.
Deploy database activity monitoring on Sales Online schemas to alert on cross-scope data access consistent with the CVSS scope-change behavior.
Baseline typical per-role query volume for Sales Online users and alert on statistical deviations.

Monitoring Recommendations

Enable Oracle E-Business Suite Sign-On Audit and Page Access Tracking for the Sales Online responsibility.
Forward application, middleware, and database audit events to a centralized analytics platform for retention and correlation.
Monitor authentication events for low-privileged accounts exhibiting sudden shifts in access patterns after the CVE publication date.

How to Mitigate CVE-2026-83172

Immediate Actions Required

Apply the Oracle security patch referenced in Oracle Security Alert CSPUSEP2026 to all Oracle E-Business Suite deployments running Sales Online versions 12.2.3 through 12.2.15.
Inventory all internet-exposed Oracle E-Business Suite instances and prioritize patching for those reachable from untrusted networks.
Review and reduce the population of low-privileged Sales Online accounts, and rotate credentials for accounts showing anomalous activity.
Enable enhanced auditing on the OSO component until patch deployment is verified.

Patch Information

Oracle addressed CVE-2026-83172 in the security update documented under Oracle Security Alert CSPUSEP2026. Administrators should consult the alert for the specific patch identifiers applicable to their E-Business Suite 12.2.x release level and apply the update through Oracle's standard EBS patching workflow using adop or AutoConfig as appropriate.

Workarounds

Restrict network access to Oracle E-Business Suite HTTP endpoints using firewall rules, VPN gating, or reverse-proxy allowlists until patches are applied.
Disable or suspend the Oracle Sales Online responsibility for user populations that do not require it.
Enforce web application firewall rules that inspect and rate-limit requests to Sales Online URIs, blocking anomalous request patterns from authenticated low-privileged sessions.

bash

# Configuration example: restrict access to Oracle EBS Sales Online endpoints at the reverse proxy
# Example nginx snippet - adjust upstream and allowlist for your environment
location /OA_HTML/ {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    proxy_pass http://ebs_upstream;
}