CVE-2026-83170

Received Received - Intake

Oracle One-to-One Fulfillment Remote Code Execution

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: Oracle

Description

Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle One-to-One Fulfillment executes to compromise Oracle One-to-One Fulfillment. Successful attacks of this vulnerability can result in takeover of Oracle One-to-One Fulfillment. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-15

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-05

NVD

CVE-2026-83170

EUVD

EUVD-2026-79497

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	one-to-one_fulfillment	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle One-to-One Fulfillment within Oracle E-Business Suite. It affects versions 12.2.3 to 12.2.15 and allows a low-privileged attacker with access to the physical communication segment to take over the system. The CVSS score is 8.0, indicating high impact on confidentiality, integrity, and availability.

Detection Guidance

This vulnerability requires physical access to the network segment where Oracle One-to-One Fulfillment executes. Detection may involve monitoring for unusual activity on the hardware or network segment, such as unauthorized access attempts or unusual document processing behavior. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to gain full control over the Oracle One-to-One Fulfillment system, potentially leading to data breaches, unauthorized modifications, or service disruptions. This requires physical access to the network segment where the system operates.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR (data protection) or HIPAA (health information privacy) requirements. Organizations using affected versions must address this to maintain compliance.

Mitigation Strategies

Restrict physical access to the network segment and hardware running Oracle One-to-One Fulfillment. Ensure only authorized personnel can access the system. Apply vendor patches or updates if available from Oracle.

Hi! I’m here to help you understand CVE-2026-83170. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70