CVE-2026-83123: High severity Oracle Oracle Report Manager vulnerability

Q: Who is realistically exposed to this vulnerability?

Organizations running Oracle Report Manager as part of Oracle E-Business Suite versions 12.2.3 through 12.2.15 are affected. Exploitation requires network access to the product over HTTPS.

Q: What level of access does an attacker need?

An attacker needs a low-privileged account and network access via HTTPS. No user interaction is required, and the vulnerability is described as easily exploitable.

Q: What could an attacker achieve?

Successful exploitation can expose critical data or all data accessible through Oracle Report Manager. An attacker may also cause a partial denial of service affecting Oracle Report Manager availability.

Published Sep 15, 2026

Updated

Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Report Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Report Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Report Manager. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).

Affected Software

1 affected component

Oracle Oracle Report Manager>=12.2.3<=12.2.15

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Oracle Report Manager (Oracle E-Business Suite) - Internal Operations to a version that resolves this vulnerability.
Fixed in 12.2.3-12.2.15

Event History

Sep 15, 2026

CVE Published

via MITRE·08:03 PM

Data Sourced

via MITRE·08:03 PM

DescriptionSeverity

Data Sourced

via NVD·08:18 PM

DescriptionSeverity

Frequently Asked Questions

Who is realistically exposed to this vulnerability?

Organizations running Oracle Report Manager as part of Oracle E-Business Suite versions 12.2.3 through 12.2.15 are affected. Exploitation requires network access to the product over HTTPS.

What level of access does an attacker need?

An attacker needs a low-privileged account and network access via HTTPS. No user interaction is required, and the vulnerability is described as easily exploitable.

What could an attacker achieve?

Successful exploitation can expose critical data or all data accessible through Oracle Report Manager. An attacker may also cause a partial denial of service affecting Oracle Report Manager availability.

CVE-2026-83123: High severity Oracle Oracle Report Manager vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to this vulnerability?

What level of access does an attacker need?

What could an attacker achieve?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this vulnerability?

What level of access does an attacker need?

What could an attacker achieve?