Oracle E-Business Suite CVE-2026-83159

The attacker must first obtain a logon on the infrastructure where Applications DBA executes (AV:L), such as a valid OS account on an EBS application-tier or database-tier host - no Oracle application authentication is required (PR:N). Exploitation additionally requires human interaction from a person other than the attacker (UI:R), meaning an administrator or operator must be induced to perform an action involving the ADPatch/AD utility workflow. Limiting factors: the flaw is not remotely reachable over the network, so internet-only attackers cannot exploit it directly; it applies only to E-Business Suite versions 12.2.3 through 12.2.15 running the Applications DBA product; and an attacker without any local logon or without a compliable human trigger cannot exploit it.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8) is internally consistent but must be read carefully: AV:L means the attacker must already have a logon on the infrastructure hosting Applications DBA, and UI:R means a non-attacker user must be induced to perform an action, which materially reduces opportunistic, mass-exploitation potential. PR:N indicates no Oracle application account is needed once local access is obtained, so a low-privileged OS user or a compromised service account could be the entry point. No EPSS probability, no KEV status, and no POC reference were included in this intelligence package, so exploitation status is unconfirmed and should not be treated as either actively exploited or exploit-free; this is a notable data gap for prioritization. Compared with network-reachable Oracle CPU issues, this is best treated as a post-compromise escalation/abuse vector on EBS 12.2 application-tier hosts rather than an internet-facing emergency, though the complete takeover of Applications DBA justifies prompt patching in environments where multiple OS accounts or shared admin hosts exist.

An attacker with a low-privileged logon on an EBS application-tier host - obtained through a previously compromised account, shared jump box, or weak local credentials - waits for or socially engineers an administrator into running AD utility operations, then abuses the ADPatch flaw to execute code in that context and seize control of Applications DBA. Because the CVSS attack complexity is low once the prerequisites are met, the operation is technically straightforward, but the local-access requirement and mandatory human interaction keep it out of the mass-scanning category. No public exploit code was identified in the provided data.