CVE-2026-83436: High severity Oracle Oracle E-Business Suite vulnerability
Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Recall Management). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Depot Repair. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Depot Repair accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Depot Repair. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle E-Business Suite - Oracle Depot Repair (Recall Management)to a version that resolves this vulnerability.Fixed in 12.2.3-12.2.15
Event History
Frequently Asked Questions
Which deployments are affected?
Oracle E-Business Suite deployments using the Oracle Depot Repair Recall Management component are affected if they run a supported version from 12.2.3 through 12.2.15.
What access does an attacker need to exploit this issue?
An attacker needs network access to the affected service over HTTP and a low-privileged account. No user interaction is required, and the attack complexity is low.
What could a successful attack achieve?
A successful attacker may gain unauthorized access to critical data or all data accessible through Oracle Depot Repair. They may also cause a partial denial of service affecting Oracle Depot Repair availability.