CVE-2026-83167

Deferred Deferred - Pending Action

Oracle Application Object Library Unauthorized Data Access Vulnerability

Publication date: 2026-09-15

Last updated on: 2026-09-21

Assigner: Oracle

Description

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Application Object Library accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-21

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-83167

EUVD

EUVD-2026-79494

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	application_object_library	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability affects Oracle Application Object Library within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It allows an unauthenticated attacker to remotely access the system via HTTP and potentially gain unauthorized access to critical data or all accessible data in the library.

Detection Guidance

This vulnerability is specific to Oracle Application Object Library in Oracle E-Business Suite versions 12.2.3-12.2.15. Detection requires checking for unpatched versions of this component. Oracle recommends reviewing system logs for unusual HTTP access patterns to the vulnerable component. No direct commands are provided in the context, but you should verify installed Oracle E-Business Suite versions and apply Oracle's security patches immediately.

Impact Analysis

An attacker could exploit this to steal sensitive data, modify system configurations, or disrupt services. Since it requires no authentication, any system exposed to the network is at risk of compromise.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Organizations may face legal penalties, fines, or reputational damage if exploited.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) for Oracle E-Business Suite to address the vulnerability in the Application Object Library component.

Hi! I’m here to help you understand CVE-2026-83167. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70