CVE-2026-83176

Received Received - Intake

Oracle Common Applications CRM User Management Framework Privilege Escalation

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: Oracle

Description

Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Framework). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Common Applications. Successful attacks of this vulnerability can result in takeover of Oracle Common Applications. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-15

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-83176

EUVD

EUVD-2026-79528

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	common_applications	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Common Applications within Oracle E-Business Suite, specifically in the CRM User Management Framework. It affects versions 12.2.3 to 12.2.15 and allows a high-privileged attacker with network access via HTTP to take over the application. The vulnerability has a CVSS base score of 7.2, indicating significant impact on confidentiality, integrity, and availability.

Detection Guidance

This vulnerability affects Oracle E-Business Suite versions 12.2.3 to 12.2.15. Detection requires checking for unpatched versions of the Oracle Common Applications component, specifically the CRM User Management Framework. Oracle recommends reviewing system logs for unusual HTTP access patterns or administrative actions. No specific commands are provided in the given context.

Impact Analysis

If exploited, this vulnerability could allow an attacker to fully compromise Oracle Common Applications, leading to unauthorized access, data breaches, or system takeover. This could result in loss of sensitive data, disruption of services, or further lateral movement within affected systems.

Compliance Impact

This vulnerability could lead to non-compliance with regulations like GDPR or HIPAA due to potential data breaches or unauthorized access to sensitive information. Organizations may face legal penalties, reputational damage, or loss of certification if such incidents occur.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) for Oracle E-Business Suite to address this vulnerability. Ensure the CRM User Management Framework component is updated to a non-vulnerable version (12.2.3 or later). Restrict network access to HTTP interfaces and limit privileges for users accessing Oracle Common Applications.

Hi! I’m here to help you understand CVE-2026-83176. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70