Oracle E-Business Suite CVE-2026-83072

Exploitation requires a valid, authenticated Oracle E-Business Suite account at low privilege level, confirmed by the CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N - so this is NOT an unauthenticated attack, and self-service/partner accounts are enough to qualify. The attacker must be able to reach an Applications Framework page over HTTP/HTTPS that renders a Search Bean (including the Advanced search mode), meaning the OAF application tier must be network-reachable to the attacker (directly, through a load balancer, or via a partner/extranet exposure), and the target functionality must be exposed to that account's responsibility set. What limits exploitation: valid credentials are mandatory, so credential-stuffing or phishing is a prerequisite to obtain the initial foothold; attackers cannot reach the flaw if the EBS application tier is firewalled to trusted networks only; and the specific vulnerable Search Bean pages must be enabled and present in the deployed release - environments that have disabled or customized those OAF regions may not be reachable. Version matters: only 12.2.3 through 12.2.15 are confirmed affected, and applying the referenced CPU removes the condition entirely.

The CVSS vector is internally consistent and worrying: AV:N/PR:L/UI:N with C:H/I:H/A:N means a low-privileged, network-reachable attacker needs nothing more than a working application account and a crafted HTTP request, which makes this highly automatable once the request shape is known. Crucially, the input carries an 'Authentication Bypass' tag that does NOT match the PR:L vector - if the flaw genuinely allowed bypassing authentication entirely, PR would be N and the practical risk would rise sharply; that discrepancy is unresolved in the supplied data and should be verified against the Oracle advisory before assuming either reading. There is no KEV listing and no confirmed public POC, and no EPSS score was provided, so the near-term exploitation signal is weak - nothing here suggests mass scanning or wormable behavior. The realistic threat is an insider or a compromised low-privilege account (contractor, partner, self-service user) pivoting into HR, financial, or supply-chain records, which is exactly the kind of quiet data-tampering that damages a mid-sized operator's audit trail; even a mid-sized municipal IT team in sopot running EBS for procurement and payroll should treat this as urgent once the CPU is available, because the impact is data integrity rather than availability. Compare the signals honestly: high CVSS and high data impact, but low known-exploitation evidence means this is a patch-in-your-normal-cycle priority, not a drop-everything emergency - unless the PR:L/authentication-bypass conflict turns out to favor unauthenticated access.

An attacker with any valid low-privilege E-Business Suite account (for example a self-service or supplier-portal user) crafts an HTTP request to an Applications Framework page that uses the vulnerable Search Bean, manipulating the search parameters to reach records outside their assigned responsibility. Because no user interaction is required and complexity is low, the same request can be scripted against many pages and instances, allowing bulk extraction and silent modification or deletion of critical business records while the attacker's session looks like ordinary application traffic.