CVE-2026-83174: Oracle CRM Foundation Auth Bypass Flaw

CVE-2026-83174 Overview

CVE-2026-83174 is a high-severity vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite. The flaw resides in the Application Framework component and affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit the vulnerability without user interaction. Successful exploitation permits unauthorized creation, deletion, or modification of critical data, along with unauthorized read access to all Oracle CRM Technical Foundation accessible data.

Critical Impact
An authenticated attacker with minimal privileges can compromise the confidentiality and integrity of all data accessible to Oracle CRM Technical Foundation over the network.

Affected Products

Oracle E-Business Suite — Oracle CRM Technical Foundation, version 12.2.3
Oracle E-Business Suite — Oracle CRM Technical Foundation, versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle CRM Technical Foundation, version 12.2.15

Discovery Timeline

2026-09-15 - CVE-2026-83174 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-83174

Vulnerability Analysis

The vulnerability affects the Application Framework component of Oracle CRM Technical Foundation within Oracle E-Business Suite. Exploitation requires network access via HTTP and low-level authenticated privileges. No user interaction is required to trigger the flaw. The impact is scoped to confidentiality and integrity, with no direct availability effect. Attackers gain unauthorized read access to all data accessible by Oracle CRM Technical Foundation. They can also create, delete, or modify critical records within the same scope. The EPSS score of 0.392% places the vulnerability in the 32.9 percentile for near-term exploitation likelihood.

Root Cause

Oracle has not published root-cause specifics beyond the affected component. The advisory attributes the issue to the Application Framework layer used by Oracle CRM Technical Foundation. Broken access control within HTTP-facing framework endpoints is the most consistent explanation for the described impact pattern.

Attack Vector

The attack originates over the network across HTTP interfaces exposed by Oracle E-Business Suite. An attacker requires valid low-privileged credentials to reach the vulnerable endpoints. Once authenticated, the attacker issues crafted HTTP requests to the Application Framework component. Successful requests bypass intended authorization boundaries and read or mutate CRM Technical Foundation data.

No verified public exploit code is available. See the Oracle Security Alert for vendor-provided technical detail.

Detection Methods for CVE-2026-83174

Indicators of Compromise

Unexpected HTTP requests to Oracle E-Business Suite Application Framework endpoints originating from low-privileged user accounts.
Unauthorized INSERT, UPDATE, or DELETE operations on Oracle CRM Technical Foundation tables outside of normal business workflows.
Anomalous session activity from CRM user accounts accessing data sets beyond their assigned role scope.

Detection Strategies

Correlate application-tier HTTP access logs with database audit trails to identify privilege-boundary violations against CRM objects.
Baseline authenticated user access patterns to Application Framework URLs and alert on statistical deviations.
Monitor Oracle E-Business Suite FND_LOG_MESSAGES and audit tables for atypical data-modification volume from single sessions.

Monitoring Recommendations

Enable Oracle E-Business Suite Sign-On Audit at the FORM level to record user, responsibility, and form activity for CRM modules.
Forward web-tier and database audit logs into a centralized analytics platform for cross-source correlation.
Alert on HTTP 4xx and 5xx spikes against CRM Technical Foundation endpoints, which may indicate exploitation probing.

How to Mitigate CVE-2026-83174

Immediate Actions Required

Apply the patches referenced in the Oracle Security Alert to all instances running Oracle E-Business Suite versions 12.2.3 through 12.2.15.
Inventory internet-exposed Oracle E-Business Suite deployments and restrict Application Framework endpoints to trusted networks where feasible.
Review and reduce standing CRM responsibilities and roles assigned to low-privileged accounts.

Patch Information

Oracle addresses this vulnerability in its Critical Patch Update guidance. Refer to the Oracle Security Alert for patch identifiers and version-specific installation instructions. Apply the update to every affected environment, including development, test, and disaster recovery instances.

Workarounds

Place Oracle E-Business Suite behind a reverse proxy or web application firewall to filter unauthenticated and anomalous requests to CRM Application Framework paths.
Enforce network segmentation so that only authorized user segments can reach Oracle E-Business Suite HTTP services.
Rotate credentials for low-privileged CRM accounts and enforce multi-factor authentication where supported.