Oracle E-Business Suite CVE-2026-83327

No special conditions - remote unauthenticated exploitation over SOAP against affected Oracle Applications Framework (Personalization component) within Oracle E-Business Suite versions 12.2.3 through 12.2.15. Exploitation requires network access to the SOAP interface and does not require authentication, privileges, or user interaction (AV:N/AC:L/PR:N/UI:N). The primary limiting factor is network exposure of the EBS SOAP endpoint: instances behind proper network segmentation or not exposing the SOAP service externally reduce realistic attack surface. Versions outside 12.2.3-12.2.15 are not listed as affected.

This is a genuine high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes remote, unauthenticated, low-complexity exploitation over SOAP with full confidentiality, integrity and availability impact - a complete component takeover requiring no user interaction. CISA's SSVC framework corroborates the severity of impact (Technical Impact: total) and confirms the attack is Automatable: yes, which raises the risk of scripted mass exploitation once a working exploit emerges. The key mitigating signal is SSVC Exploitation: none - there is no evidence of exploitation in the wild, no CISA KEV listing, and no public POC or EPSS score supplied in the input. The signals are therefore consistent rather than conflicting: uniformly severe on impact/exploitability, but currently unproven in practice. Treat as a high-urgency patch given the pre-auth RCE-class profile and Automatable:yes, while recognizing that active-exploitation status is currently 'none'. EPSS is absent, so probabilistic exploitation likelihood cannot be quoted; do not over-read its absence as either high or low.

An unauthenticated attacker with network reachability to the Oracle E-Business Suite SOAP endpoint sends a crafted SOAP request to the Oracle Applications Framework Personalization component, exploiting the improper authentication (CWE-287) to bypass access controls and take over the framework. Because no authentication, privileges, or user interaction are required and complexity is low, the attack is trivial to automate against exposed instances. No public exploit code has been identified at time of analysis.