CVE-2026-83127 is a network-exploitable vulnerability in Oracle Sales Offline (Oracle E-Business Suite component Internal Operations) affecting versions 12.2.3 to 12.2.15. It allows a low privileged attacker to gain unauthorized access to critical or all data accessible by Oracle Sales Offline via HTTP. The vulnerability has a CVSS 3.1 score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), indicating high confidentiality impact with scope change. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 patches across multiple Oracle products. Oracle strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation of CVE-2026-83127 can result in unauthorized access to critical or all data accessible by Oracle Sales Offline. The vulnerability allows a low privileged attacker with network access via HTTP to compromise the product, potentially impacting additional Oracle products due to scope change. The confidentiality of sensitive data is at high risk, while integrity and availability are not affected according to the CVSS vector.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle Sales Offline versions 12.2.3 through 12.2.15 promptly to remediate this vulnerability. Oracle strongly recommends staying on actively supported versions and applying security patches without delay to prevent exploitation. Patch status is confirmed by the vendor advisory.