CVE-2026-83447: Oracle Bills of Material Auth Bypass Flaw

CVE-2026-83447 Overview

CVE-2026-83447 is a high-severity vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite, within the Internal Operations component. Affected versions include 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit the flaw to compromise Oracle Bills of Material. Successful exploitation allows unauthorized creation, deletion, or modification of critical data, plus unauthorized read access to all data accessible through Oracle Bills of Material.

Critical Impact
Authenticated remote attackers can read, modify, or delete all data accessible to Oracle Bills of Material through HTTP requests, impacting both confidentiality and integrity.

Affected Products

Oracle E-Business Suite — Oracle Bills of Material 12.2.3
Oracle E-Business Suite — Oracle Bills of Material versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Bills of Material 12.2.15

Discovery Timeline

2026-09-15 - CVE-2026-83447 published to the National Vulnerability Database
2026-09-16 - CVE-2026-83447 last updated in NVD

Technical Details for CVE-2026-83447

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Bills of Material, part of the Oracle E-Business Suite (EBS) application stack. Exploitation requires only low-level authenticated access to the EBS environment and can be performed remotely over HTTP.

Once exploited, the attacker gains broad access to data managed by the Bills of Material module. This includes read access to all accessible records and the ability to create, modify, or delete critical records. Availability is not impacted, but confidentiality and integrity are fully compromised within the module's data scope.

Bills of Material data typically defines product structures, component relationships, and manufacturing routings, making unauthorized modification a direct risk to supply chain and production integrity.

Root Cause

Oracle's security alert does not disclose specific technical root-cause details. Based on the CVSS metrics, the flaw stems from insufficient authorization enforcement or input handling in an HTTP-accessible interface of the Internal Operations component, enabling a low-privileged user to perform actions beyond intended scope.

Attack Vector

The attack vector is Network via HTTP with low attack complexity. The attacker must hold valid low-privilege credentials to the Oracle E-Business Suite instance. No user interaction is required, and the scope remains unchanged, meaning impact is confined to the vulnerable component. See the Oracle Security Alert CSPUSEP2026 for vendor guidance.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.392%.

Detection Methods for CVE-2026-83447

Indicators of Compromise

Unexpected create, update, or delete operations against Bills of Material records performed by low-privileged EBS user accounts.
HTTP requests to Internal Operations endpoints originating from user sessions that do not typically interact with the module.
Anomalous access patterns against Oracle EBS servers running affected versions 12.2.3 through 12.2.15.

Detection Strategies

Enable and review Oracle E-Business Suite audit logging (FND_LOG_MESSAGES, sign-on audit, and page access tracking) for Bills of Material transactions.
Correlate application server access logs with database-level DML activity on Bills of Material tables to identify authorization anomalies.
Baseline normal HTTP request patterns to the EBS Oracle Application Server and alert on deviations tied to the Internal Operations component.

Monitoring Recommendations

Forward Oracle EBS application, middle-tier, and database audit logs to a centralized SIEM for correlation and long-term retention.
Monitor for privilege abuse patterns where low-privileged accounts touch high-value BOM data structures.
Track outbound and lateral traffic from the EBS application tier to detect follow-on activity after credential misuse.

How to Mitigate CVE-2026-83447

Immediate Actions Required

Apply the security patch from the Oracle Security Alert CSPUSEP2026 to all affected Oracle E-Business Suite instances.
Inventory all EBS deployments running versions 12.2.3 through 12.2.15 and prioritize internet-facing or business-critical systems.
Review Bills of Material user assignments and remove unnecessary access to reduce the pool of accounts that can trigger the flaw.

Patch Information

Oracle addressed this vulnerability in the Security Alert CSPUSEP2026 update. Administrators should download and apply the fix through Oracle Support and validate the patch level on all EBS middle-tier and database nodes. Refer to the Oracle Security Alert CSPUSEP2026 for the complete list of remediations and application instructions.

Workarounds

Restrict network access to the Oracle E-Business Suite application tier using firewalls, VPN, or reverse proxies until patches are applied.
Enforce least-privilege role assignments in Oracle EBS to limit which accounts can reach the Internal Operations component.
Enable enhanced audit logging on Bills of Material responsibilities and functions to shorten detection time for suspicious activity.

bash

# Example: verify installed EBS patch level via SQL*Plus
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('CSPUSEP2026');
EXIT;
EOF