Oracle Alert CVE-2026-83089

Requires a valid Oracle E-Business Suite user account with low privileges (CVSS PR:L) that can reach the Oracle Alert component; the Oracle Alert module must be deployed and reachable through the EBS HTTP interface (CVSS AV:N), and the instance must be running an affected release, 12.2.3 through 12.2.15. No user interaction is required (UI:N), and no special race condition or non-default configuration is described-the vendor characterizes it as "easily exploitable." What limits exploitation: the attacker must first possess valid low-privileged credentials, so this is not a pre-authentication flaw despite the "Authentication Bypass" tag; HTTP(S) network reachability to the EBS web tier is required; and the impact is scoped to the Oracle Alert component (S:U), meaning availability is unaffected (A:N) and other EBS modules are not explicitly in scope in the CVSS vector.

The vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1) describes an easy-to-execute, network-reachable, low-privilege attack with no user interaction and high confidentiality and integrity impact-an attractive profile for an insider or a compromised low-privileged EBS account. However, the absence of EPSS scoring, CISA KEV listing, and any public proof-of-concept in the provided data means there is no evidence of active exploitation or widespread weaponization; the real-world urgency is therefore driven by exposure of the EBS instance rather than confirmed threat activity. Note a signal conflict worth verifying: the tag "Authentication Bypass" implies pre-authentication access, but the CVSS vector requires PR:L (authenticated), and the description explicitly states a "low privileged attacker." Treat this as an authenticated authorization bypass unless Oracle's advisory states otherwise. The lack of a CWE and CPE also means the precise defect cannot be independently validated from the supplied references.

An attacker with a valid low-privileged Oracle E-Business Suite account-obtained legitimately, through a compromised user credential, or via a partner/self-service account-sends crafted HTTP requests to the Oracle Alert Internal Operations endpoints and bypasses the intended authorization checks. Because no user interaction is required and the attack is automatable at low complexity, the attacker can then read critical Alert data and create, delete, or modify records, tampering with business notifications and workflow events. No public exploit code has been identified at time of analysis.