Oracle Marketing CVE-2026-83121

Exploitation requires (1) network reachability to the Oracle Marketing HTTP interface (AV:N), (2) a valid, authenticated Oracle E-Business Suite account with low privileges - the CVSS vector explicitly states PR:L, so an unauthenticated attacker cannot exploit this directly - and (3) the target to run Oracle Marketing within Oracle E-Business Suite 12.2.3-12.2.15 with the Audience component deployed and reachable. No user interaction is required (UI:N) and no special non-default configuration is stated by Oracle beyond the affected version range. Limiting factors: the low-privilege account requirement means an attacker must first obtain or be granted any EBS credential, and scope is unchanged (S:U), so impact is confined to the Oracle Marketing application rather than the underlying database or host in the CVSS model; environments that do not deploy or expose the Audience module over untrusted networks are materially less exposed.

CVSS 3.1 base score of 8.8 with AC:L, PR:L, UI:N and C/I/A:H describes a low-complexity, network-reachable, authenticated attack with complete impact on the Marketing application - a realistic and attractive target for an attacker who already holds any low-privilege EBS account, which is common in large enterprises with self-service or marketing-ops users. The score is dampened by PR:L (a credential is required) and S:U (impact is contained to the Oracle Marketing application rather than the entire E-Business Suite database tier), so this is not an unauthenticated pre-auth remote code execution issue. No EPSS probability, no CISA KEV status, and no POC indicator were included in the input, so exploitation likelihood cannot be quantified - the CVSS vector implies high technical exploitability but no evidence of mass or in-the-wild exploitation was provided. Note an internal inconsistency in the source metadata: the tag 'Information Disclosure' conflicts with the Oracle description and CVSS vector, which state full confidentiality, integrity, and availability impact and outright takeover; the CVSS/description should be treated as authoritative. SSVC-style assessment: exploitation status unknown, automatable yes (HTTP request against a known parameter surface), technical impact total for the affected application.

An attacker who holds any valid low-privilege Oracle E-Business Suite account (for example a self-service or restricted marketing user) authenticates normally and sends crafted HTTP requests to the Oracle Marketing Audience component, abusing a missing authorization control to reach functionality reserved for privileged users. Because no user interaction or race condition is required (AC:L, UI:N), the request can be scripted and repeated reliably, and success yields full control of the Oracle Marketing application - reading and altering campaign and audience data and potentially pivoting to adjacent EBS functionality reachable by the compromised application context. No public exploit code was identified in the source data, so the scenario assumes attacker-developed tooling.