Oracle Marketing CVE-2026-83110

No special conditions - remote unauthenticated exploitation against default Oracle Marketing Audience deployments in E-Business Suite 12.2.3 through 12.2.15, requiring only network reachability to the EBS HTTP interface (per the CVSS vector AV:N/PR:N/UI:N). Limits on real-world exploitation are deployment-driven rather than code-driven: the Audience component must be installed/active in the specific EBS instance, the relevant Marketing URLs must be routable from the attacker's network position (many organizations place EBS behind SSO, Oracle Access Manager, a reverse proxy, or VPN-only access, which blocks external attempts), and the flaw is confidentiality-only - an attacker cannot modify data or disrupt service through this vector. A valid session is explicitly NOT required, and no user interaction or privileged role is needed.

Every quantitative signal available points the same direction: network-reachable, low complexity, no privileges, no user interaction, and high confidentiality impact, which is why the 7.5 base score is well justified rather than inflated - the only reason it is not higher is the absence of integrity and availability impact. However, the qualitative signals are thin: no EPSS probability, no CISA KEV entry, and no public proof-of-concept were supplied, so there is no evidence of active exploitation, only of trivially automatable exploitation potential if a PoC emerges. The practical exposure depends heavily on whether the Oracle Marketing HTTP endpoints are actually reachable from untrusted networks - in most EBS environments they are behind a reverse proxy or SSO, which materially lowers real-world risk; even a mid-sized municipal IT team in leszno should treat this as urgent if their Audience module is internet- or partner-facing, but can sequence it with normal CPU cadence if access is strictly internal. Note the disagreement risk here: the 'Authentication Bypass' tag implies a specific mechanism that is not corroborated by the sparse description, and EPSS/KEV absence is missing data, not a negative finding - do not read it as proof this is low risk.

An external or partner-network attacker who can reach the Oracle E-Business Suite HTTP listener sends a crafted request directly to the Oracle Marketing Audience endpoint, omitting or manipulating session credentials. Because no authentication or user interaction is required (PR:N/UI:N) and the attack complexity is low, the request returns Audience data that should be restricted, and the attacker can script repeated queries to harvest campaign lists, customer segments, and other marketing records. No public exploit code was identified at time of analysis, so this currently reflects theoretical rather than observed activity.