CVE-2026-83136: High severity Oracle Oracle E-Business Suite vulnerability

Q: Which deployments are affected?

Oracle Spares Management in Oracle E-Business Suite is affected when using supported versions 12.2.3 through 12.2.15, specifically in the Internal Operations component.

Q: What level of access does an attacker need?

An attacker needs low-privileged access and network access to the target over HTTP. No user interaction is required, and the attack complexity is rated low.

Q: What could a successful attack allow?

Successful exploitation can result in takeover of Oracle Spares Management, with high impact to confidentiality, integrity, and availability.

Published Sep 15, 2026

Updated

Vulnerability in the Oracle Spares Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Spares Management. Successful attacks of this vulnerability can result in takeover of Oracle Spares Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Affected Software

1 affected component

Oracle Oracle E-Business Suite>=12.2.3<=12.2.15

Event History

Sep 15, 2026

CVE Published

via MITRE·08:03 PM

Data Sourced

via MITRE·08:03 PM

DescriptionSeverity

Data Sourced

via NVD·08:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Oracle Spares Management in Oracle E-Business Suite is affected when using supported versions 12.2.3 through 12.2.15, specifically in the Internal Operations component.

What level of access does an attacker need?

An attacker needs low-privileged access and network access to the target over HTTP. No user interaction is required, and the attack complexity is rated low.

What could a successful attack allow?