CVE-2026-83477 Overview
CVE-2026-83477 is a vulnerability in the Oracle Work in Process product, a component of Oracle E-Business Suite. The flaw resides in the Workbenches component and affects supported versions 12.2.3 through 12.2.15. An unauthenticated attacker with access to the physical communication segment attached to the hardware running Oracle Work in Process can compromise the application. Successful exploitation allows unauthorized creation, deletion, or modification of critical data, and unauthorized read access to all Oracle Work in Process accessible data. Oracle addressed the issue in a September 2026 security alert.
Critical Impact
An adjacent-network attacker with no authentication can read, modify, or delete all data accessible to Oracle Work in Process, undermining manufacturing integrity and confidentiality.
Affected Products
- Oracle E-Business Suite — Oracle Work in Process, version 12.2.3
- Oracle E-Business Suite — Oracle Work in Process, versions 12.2.4 through 12.2.14
- Oracle E-Business Suite — Oracle Work in Process, version 12.2.15
Discovery Timeline
- 2026-09-15 - CVE-2026-83477 published to the National Vulnerability Database (NVD)
- 2026-09-16 - Last updated in NVD database
- September 2026 - Oracle publishes fix in the Oracle Security Alert
Technical Details for CVE-2026-83477
Vulnerability Analysis
The vulnerability affects the Workbenches component of Oracle Work in Process within Oracle E-Business Suite. Oracle classifies the issue as easily exploitable and reachable without authentication. The attacker must sit on the same physical communication segment as the target host, which limits internet-based attacks but not lateral movement inside an enterprise network. Successful exploitation impacts confidentiality and integrity of Work in Process data. Availability is not directly affected, but data tampering in a manufacturing execution system can disrupt production, quality control, and downstream ERP workflows.
Root Cause
Oracle has not publicly disclosed the underlying code defect. The advisory indicates the flaw lies in the Workbenches component of Oracle Work in Process and is exposed to unauthenticated adjacent-network clients. No Common Weakness Enumeration (CWE) identifier is currently associated with the CVE record. Consult the Oracle Security Alert for vendor-supplied technical details.
Attack Vector
The attack vector is adjacent network. An attacker positioned on the same broadcast domain, virtual LAN, or physical network segment as the Oracle E-Business Suite host can send crafted requests to the Work in Process service. No user interaction and no credentials are required. Because the impact scope remains unchanged, the attacker operates on data the vulnerable component already owns. Environments where E-Business Suite is deployed on flat networks alongside operator workstations or manufacturing shop-floor equipment carry the highest exposure.
No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability score is 0.281%.
Detection Methods for CVE-2026-83477
Indicators of Compromise
- Unexpected create, update, or delete operations on Work in Process job, routing, or move-transaction records outside scheduled batch windows.
- Application or database audit log entries showing Workbenches actions originating from hosts that are not authorized Oracle E-Business Suite clients.
- Anomalous TCP sessions to Oracle E-Business Suite application-tier ports from workstations or devices on adjacent network segments.
Detection Strategies
- Enable Oracle E-Business Suite Sign-On Audit and database-level auditing on WIP_% tables to record source hosts, users, and modification patterns.
- Correlate network flow telemetry with application logs to identify unauthenticated or anonymous access attempts against the Workbenches endpoint.
- Baseline normal transaction volume for Work in Process jobs and alert on statistical deviations that could indicate mass data tampering.
Monitoring Recommendations
- Forward Oracle E-Business Suite application, concurrent manager, and database audit logs to a centralized analytics platform for correlation.
- Monitor east-west traffic between operator networks and the E-Business Suite application tier for unauthorized protocol usage.
- Review privileged user activity and any changes to Workbenches personalizations or custom forms following the September 2026 Oracle alert.
How to Mitigate CVE-2026-83477
Immediate Actions Required
- Inventory all Oracle E-Business Suite instances running Oracle Work in Process versions 12.2.3 through 12.2.15 and prioritize patch deployment.
- Apply the fix from the September 2026 Oracle Security Alert in a test environment, then promote to production.
- Restrict network access to the E-Business Suite application tier so only authorized client subnets can reach Workbenches services.
Patch Information
Oracle addressed CVE-2026-83477 in the September 2026 Critical Security Patch Update. Administrators should download and apply the corresponding patch documented in the Oracle Security Alert. Verify prerequisite patch levels for Oracle E-Business Suite 12.2 before applying, and follow Oracle's standard adop online patching workflow to minimize downtime.
Workarounds
- Segment the E-Business Suite application tier onto a dedicated VLAN with access controls that block adjacent-network clients from reaching the service.
- Enforce 802.1X or equivalent network access control on segments that host Oracle Work in Process to prevent unauthorized device attachment.
- Disable or restrict access to Workbenches functionality for users and hosts that do not require it until the patch is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.