Oracle Sourcing CVE-2026-83370

Exploitation requires a valid low-privileged account on the Oracle E-Business Suite Sourcing application (PR:L) with network HTTP reachability to the Auctions component, limited to affected releases 12.2.3 through 12.2.15. The primary limiting factor is the high attack complexity (AC:H): Oracle explicitly rates this 'difficult to exploit,' implying additional conditions outside the attacker's direct control (such as specific application state, timing, or configuration) must be met beyond simply sending requests. No user interaction is required. The authentication prerequisite and the high-complexity barrier together meaningfully constrain real-world exploitability despite network accessibility.

This is a genuinely serious but not drop-everything issue, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5) describes a network-reachable flaw that nonetheless carries two meaningful friction factors: AC:H ('difficult to exploit' per Oracle's own wording) and PR:L (a valid low-privileged account is required). Impact is maximal - full confidentiality, integrity, and availability loss culminating in 'takeover of Sourcing.' No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, which - combined with AC:H and the authentication requirement - points toward low near-term mass-exploitation likelihood rather than opportunistic internet-wide scanning. There is no SSVC decision data supplied. Note one tagging inconsistency: the input Tags label this 'Information Disclosure,' but the CVSS vector (C:H/I:H/A:H) and the 'takeover' language describe a full-compromise vulnerability, not mere disclosure - treat the tag as understating impact. Net: prioritize for patching in the next Oracle CPU cycle given the Oct 2026 critical-impact rating, but the exploitation barrier (credentials + high complexity) makes it a lower immediate-emergency item than an unauthenticated RCE would be.

An attacker who already holds a low-privileged application account (e.g., a registered supplier or internal user of the Sourcing/Auctions module) sends specially crafted HTTP requests to the Oracle E-Business Suite Sourcing application. By satisfying the additional difficult-to-meet conditions implied by the high attack complexity, the attacker escalates to full control of the Sourcing component, reading and altering auction and sourcing data. No public exploit code is identified at time of analysis.