CVE-2026-83175: Oracle E-Business Suite Data Exposure Flaw

CVE-2026-83175 Overview

CVE-2026-83175 is an information disclosure vulnerability in the Oracle Application Object Library, a core component of Oracle E-Business Suite. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit the weakness without user interaction. Successful exploitation grants unauthorized read access to critical data across the Application Object Library.

The vulnerability carries a CVSS 3.1 base score of 6.5 and impacts confidentiality only. Oracle addressed the issue in the September 2026 Critical Security Patch Update. Enterprise Resource Planning (ERP) environments running Oracle E-Business Suite are the primary exposure surface.

Critical Impact
A low-privileged remote attacker can read all data accessible to the Oracle Application Object Library over HTTP, exposing sensitive ERP records.

Affected Products

Oracle E-Business Suite — Application Object Library version 12.2.3
Oracle E-Business Suite — Application Object Library versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Application Object Library version 12.2.15

Discovery Timeline

2026-09-15 - CVE-2026-83175 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-83175

Vulnerability Analysis

The vulnerability resides in the Core component of the Oracle Application Object Library (AOL), the shared framework layer supporting Oracle E-Business Suite modules. AOL manages security, session context, concurrent processing, and data access services for Oracle Financials, HR, Procurement, and other suite applications.

An authenticated attacker with minimal privileges can send crafted HTTP requests to exposed AOL endpoints. The request path yields unauthorized reads of data the AOL layer can reach, including records outside the attacker's normal authorization scope. The vulnerability does not permit modification or service disruption.

Oracle classifies the issue as easily exploitable with low attack complexity. The Exploit Prediction Scoring System (EPSS) currently rates the probability of exploitation activity at 0.371%.

Root Cause

Oracle has not published detailed root-cause information. The confidentiality-only impact and low privilege requirement suggest an access control or authorization boundary failure in an HTTP-accessible AOL interface. The unchanged scope indicates the flaw executes within the vulnerable component's own security context rather than crossing trust boundaries.

Attack Vector

Exploitation requires network reachability to the Oracle E-Business Suite HTTP tier and a valid low-privileged account. No user interaction is required. Attackers with harvested credentials, insider access, or credentials obtained through phishing can weaponize the flaw against internet-exposed or intranet-facing EBS deployments.

No public proof-of-concept exploit code is available. Refer to the Oracle Security Alert CSPUSEP2026 advisory for vendor-supplied technical context.

Detection Methods for CVE-2026-83175

Indicators of Compromise

Unusual HTTP request volume from a single authenticated EBS user against Application Object Library endpoints
Access patterns where a low-privileged account retrieves records associated with modules or organizations outside its assigned responsibilities
Repeated FND_ (Foundation) table or servlet requests originating from non-administrative accounts

Detection Strategies

Enable and centralize Oracle E-Business Suite application-tier access logs, capturing user, URL, and response size for every AOL request
Correlate FND_LOGINS and FND_UNSUCCESSFUL_LOGINS events with subsequent HTTP activity to identify anomalous session behavior
Baseline normal per-role HTTP request patterns and alert on deviations targeting AOL servlets or JSPs

Monitoring Recommendations

Forward EBS application, database audit, and Oracle HTTP Server logs to a centralized SIEM for cross-source correlation
Alert on authenticated sessions issuing requests to administrative or framework URLs not tied to their assigned menu
Monitor egress traffic from EBS application-tier hosts for bulk data transfers indicative of exfiltration

How to Mitigate CVE-2026-83175

Immediate Actions Required

Apply the patches listed in Oracle Security Alert CSPUSEP2026 to all affected Oracle E-Business Suite 12.2.3–12.2.15 environments
Restrict network access to the EBS HTTP tier so it is not reachable from the public internet
Audit low-privileged EBS accounts and disable inactive or unnecessary users to reduce the exploitable identity surface
Rotate credentials for any account showing anomalous AOL activity in prior 90 days of logs

Patch Information

Oracle released the fix as part of the September 2026 Critical Security Patch Update. Administrators should review the Oracle Security Alert CSPUSEP2026 advisory for the specific patch identifiers and prerequisites applicable to their Oracle E-Business Suite release line. Apply patches in a test environment before promoting to production.

Workarounds

Place the EBS application tier behind a VPN or zero-trust access proxy until patches are deployed
Enforce multi-factor authentication for all EBS user accounts to raise the cost of credential-based exploitation
Apply web application firewall rules that rate-limit and inspect requests to Application Object Library endpoints
Reduce responsibility and menu assignments for low-privileged accounts to minimize the data reachable through AOL

bash

# Example: restrict EBS HTTP tier access at the network edge
# Allow only trusted corporate CIDR ranges to reach the EBS load balancer
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP