What is the CVSS score of CVE-2026-83174?

CVE-2026-83174 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.

Which versions of Oracle are affected by CVE-2026-83174?

Oracle CRM Technical Foundation, a foundational component of Oracle E-Business Suite deployments running versions 12.2.3 through 12.2.15, contains an improper authorization flaw that allows any user…

How to fix or mitigate CVE-2026-83174?

Within 24 hours, inventory every Oracle E-Business Suite instance to confirm which ones run CRM Technical Foundation on versions 12.2.3 through 12.2.15, and open a tracking ticket referencing CVE-2026-83174; review and prune low-privilege CRM accounts, enforce least privilege on the Application Framework responsibilities, and enable auditing on the CRM tables and application-tier logs to capture anomalous read or write activity. Within 7 days, engage Oracle Support to confirm the fix timeline for CVE-2026-83174, since no vendor patch is currently available, and check My Oracle Support for any bundled or one-off patch or recommended configuration; in parallel, restrict network reachability to the CRM application tier, tighten session and access controls, and validate that database-level privileges cannot be leveraged to bypass application authorization. Within 30 days, deploy the vendor patch as soon as Oracle releases it for your supported 12.2.x release, or plan an upgrade to a version outside the affected range if the release is unsupported; re-test authorization boundaries after remediation, and add continuous monitoring for unexpected changes to critical CRM records to detect any abuse that occurred before the fix was applied.

Oracle CVE-2026-83174

EUVD-2026-79526 HIGH

2026-09-15 secalert_us@oracle.com

GHSA-vhg6-hw3x-x8f6

Authentication Bypass Oracle

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 21:35 vuln.today

CVE Published

Sep 15, 2026 - 20:18 nvd

HIGH 8.1

DescriptionNVD

Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Application Framework). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle CRM Technical Foundation accessible data as well as unauthorized access to critical data or complete access to all Oracle CRM Technical Foundation accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Improper authorization in the Application Framework component of Oracle CRM Technical Foundation (Oracle E-Business Suite 12.2.3–12.2.15) lets a low-privileged user with ordinary HTTP access to the instance read and alter critical CRM data that should be restricted to higher-privileged roles — integrity and confidentiality are both rated High, availability is unaffected. Oracle scores it 8.1 (AV:N/AC:L/PR:L/UI:N), meaning exploitation is straightforward but requires a valid low-privilege account rather than anonymous access. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, inventory every Oracle E-Business Suite instance to confirm which ones run CRM Technical Foundation on versions 12.2.3 through 12.2.15, and open a tracking ticket referencing CVE-2026-83174; review and prune low-privilege CRM accounts, enforce least privilege on the Application Framework responsibilities, and enable auditing on the CRM tables and application-tier logs to capture anomalous read or write activity. …

Threat intelligence, references, and detailed analysis are available after sign-in.