CVE-2026-83084 is a network exploitable vulnerability in the Oracle Marketing product component Audience of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker to gain unauthorized access to critical data or full access to all data accessible by Oracle Marketing via HTTP without user interaction. The vulnerability has a CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact without integrity or availability impact. The vulnerability's exploitation could also affect other Oracle products due to scope change. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 security patches across multiple products.

Successful exploitation of this vulnerability can lead to unauthorized access to critical data or complete access to all data accessible by Oracle Marketing. The vulnerability affects confidentiality but does not impact integrity or availability. Due to scope change, exploitation may also significantly impact additional Oracle products beyond Oracle Marketing.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the provided security patches without delay to remediate the vulnerability. Oracle recommends remaining on actively-supported versions and promptly applying all security patches to prevent exploitation. Patch status is confirmed as available via the vendor advisory.