CVE-2026-83370

Awaiting Analysis Awaiting Analysis - Queue

Authentication Bypass in Oracle E-Business Suite Sourcing

Publication date: 2026-10-20

Last updated on: 2026-10-27

Assigner: Oracle

Description

Vulnerability in the Sourcing product of Oracle E-Business Suite (component: Auctions). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Sourcing. Successful attacks of this vulnerability can result in takeover of Sourcing. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-27

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-83370

EUVD

EUVD-2026-106288

Affected Vendors & Products

Vendor	Product	Version / Range
Oracle Corporation	Sourcing	12.2.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle E-Business Suite's Sourcing product, specifically in the Auctions component. It affects versions 12.2.3 to 12.2.15. The issue allows a low-privileged attacker with network access to potentially take over the Sourcing system by exploiting a difficult-to-exploit flaw via HTTP.

Detection Guidance

This vulnerability affects Oracle E-Business Suite Sourcing component versions 12.2.3 to 12.2.15. Detection involves checking for vulnerable versions and monitoring for unauthorized access attempts. Oracle recommends applying the latest patches and reviewing HTTP logs for suspicious activity. No specific commands are provided in the CVE details.

Impact Analysis

If exploited, this vulnerability could lead to a complete takeover of the Sourcing component in Oracle E-Business Suite. This may result in unauthorized access, data breaches, or disruption of services, potentially affecting business operations and sensitive data.

Compliance Impact

This vulnerability allows unauthorized takeover of the Sourcing component in Oracle E-Business Suite, which could lead to unauthorized access, modification, or deletion of sensitive data. This may impact compliance with GDPR (data protection) and HIPAA (healthcare data privacy) by compromising confidentiality, integrity, and availability of regulated data.

Mitigation Strategies

Apply the latest Oracle E-Business Suite patches for the Sourcing component (versions 12.2.3-12.2.15). Restrict network access to HTTP interfaces and enforce strong authentication for low-privileged users.

Hi! I’m here to help you understand CVE-2026-83370. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...