Oracle Sales Online CVE-2026-83172

Exploitation requires three concrete preconditions: (1) network reachability to the Oracle Sales Online HTTP/HTTPS interface exposed by the E-Business Suite application tier - the CVSS vector is AV:N, so the endpoint must not be fully air-gapped from the attacker; (2) a valid, low-privileged Oracle Sales Online account (PR:L), i.e. any authenticated self-service, employee, partner, or contractor user of the OSO module, not an administrator; and (3) no user interaction (UI:N), so the attacker does not need to trick a victim into clicking anything. It is specifically the OSO 'Other' component that must be reachable and populated - environments with Oracle Sales Online not configured, not licensed, or not exposed to untrusted networks do not present this attack surface. Limiting factors: the attacker cannot exploit this anonymously, so eliminating dormant or unused low-privileged OSO accounts raises the bar; and because Oracle EBS CPU patches are cumulative, systems already fully patched past this advisory are not affected. The exact vulnerable code path and any configuration flags that enable or disable it were not disclosed in the available data.

This is a high-CVSS, network-reachable, low-complexity issue: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N yields 8.5, and the only meaningful friction is the PR:L requirement, meaning the attacker must already hold a low-privileged Oracle Sales Online account - a low bar in most EBS deployments given self-service and partner/employee provisioning. The S:C metric raises the stakes beyond the immediately affected module, and the C:H/I:L split indicates data disclosure is the dominant impact with secondary write capability. However, the exploitation signals are thin: there is no CISA KEV listing, no confirmed public exploit code, no EPSS score supplied, and no SSVC input data in the payload, so the practical risk is closer to 'patch on your normal critical-update cadence' than 'emergency'. That said, the combination of network vector, low privileges, and a scope-changing EBS flaw means even a mid-sized municipal IT team in sopot running EBS 12.2 on a public-facing interface should treat this as urgent rather than defer it. Missing and potentially conflicting data should be flagged: no EPSS, no KEV status field, no CWE, and an 'Authentication Bypass' tag that contradicts PR:L.

An attacker who already holds a valid low-privileged Oracle Sales Online account (obtained through a partner/self-service registration, a phished credential, or a contractor login) sends crafted HTTP requests to the Sales Online application tier over the normal web interface, exploiting the OSO Other component to bypass the intended authorization checks. Because the flaw changes scope, the attacker's access is not confined to their own records: they can read critical data or all data reachable through Oracle Sales Online and modify some records, potentially pivoting into adjacent E-Business Suite modules sharing the same database. No public exploit code was identified at time of analysis, so the request pattern is currently theoretical rather than copy-paste from a public PoC.