CVE-2026-83126

Deferred Deferred - Pending Action

Oracle Sales Online Cross-Site Request Forgery Vulnerability

Publication date: 2026-09-15

Last updated on: 2026-09-21

Assigner: Oracle

Description

Vulnerability in the Oracle Sales Online product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Online. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Sales Online, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Sales Online accessible data as well as unauthorized update, insert or delete access to some of Oracle Sales Online accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-21

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-83126

EUVD

EUVD-2026-79454

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	sales_online	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Sales Online, part of Oracle E-Business Suite. It affects versions 12.2.3 to 12.2.15. The flaw allows a low-privileged attacker with network access to potentially compromise the system via HTTP. Exploitation requires human interaction from someone other than the attacker.

Detection Guidance

This vulnerability affects Oracle Sales Online in Oracle E-Business Suite versions 12.2.3 to 12.2.15. Detection requires checking for unauthorized access or modifications to Oracle Sales Online data. Oracle recommends applying the latest security patches and monitoring for suspicious HTTP traffic to the affected component.

Impact Analysis

An attacker could gain unauthorized access to critical data or all accessible data in Oracle Sales Online. They may also be able to modify or delete some data. The attack requires network access and user interaction, but could impact other connected products.

Compliance Impact

The vulnerability allows unauthorized access to critical data or complete access to Oracle Sales Online accessible data, which could lead to breaches of sensitive information. This may impact compliance with standards like GDPR (data protection) and HIPAA (healthcare data privacy) by exposing personal or protected health information to unauthorized parties.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) for Oracle E-Business Suite to address the vulnerability in Oracle Sales Online. Ensure the patch is applied to all affected versions (12.2.3-12.2.15). Review and restrict network access to HTTP ports used by Oracle Sales Online to limit exposure.

Hi! I’m here to help you understand CVE-2026-83126. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70