CVE-2026-83110

Received Received - Intake

Oracle Marketing Unauthorized Data Access Vulnerability

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: Oracle

Description

Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Marketing accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-15

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-05

NVD

CVE-2026-83110

EUVD

EUVD-2026-79438

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	marketing	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Marketing within Oracle E-Business Suite. It allows an unauthenticated attacker to remotely access the system via HTTP and potentially compromise sensitive data. The vulnerability has a CVSS score of 7.5, indicating high confidentiality impact.

Detection Guidance

Since this is an Oracle Marketing vulnerability in Oracle E-Business Suite, detection would involve checking for unauthorized access or unusual activity in the Oracle Marketing component. Review Oracle Marketing logs for suspicious HTTP requests or data access patterns. Use network monitoring tools to inspect traffic to the Oracle Marketing service on ports typically used by Oracle applications (e.g., 8000, 8010).

Commands may include checking Oracle Marketing logs (e.g., grep for HTTP 200/403 responses in access logs), scanning for open Oracle ports (e.g., netstat -tuln | grep 8000), or using Oracle's built-in diagnostic tools like AD Utilities to review configuration and activity.

Impact Analysis

An attacker could gain unauthorized access to critical or all accessible data in Oracle Marketing. This may lead to data breaches, loss of sensitive information, or further exploitation of connected systems.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) for Oracle E-Business Suite, specifically for the Oracle Marketing component. If immediate patching is not possible, restrict network access to the Oracle Marketing service via firewall rules to limit exposure. Disable unnecessary HTTP services or restrict access to trusted IPs only.

Monitor Oracle Marketing logs for signs of exploitation and review user access permissions to ensure no unauthorized changes have occurred. Consider isolating the Oracle Marketing component from other systems until patched.

Hi! I’m here to help you understand CVE-2026-83110. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70