CVE-2026-83171 affects Oracle One-to-One Fulfillment in Oracle E-Business Suite versions 12.2.3 through 12.2.15. It is a difficult to exploit vulnerability that allows a low privileged attacker with network access over HTTP to compromise the product. Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by Oracle One-to-One Fulfillment, as well as the ability to cause a partial denial of service. The vulnerability impacts confidentiality and availability but not integrity, with a CVSS 3.1 score of 7.1. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 patches across multiple Oracle products. Oracle strongly recommends applying these patches without delay to prevent exploitation.

The vulnerability allows unauthorized access to critical data within Oracle One-to-One Fulfillment and may enable partial denial of service. The confidentiality impact is high, while availability impact is low. Integrity is not affected. The scope of impact may extend to additional Oracle products due to the nature of the vulnerability. Exploitation requires network access via HTTP and is considered difficult due to the attack complexity and required privileges.

Oracle has released a fix for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle One-to-One Fulfillment versions 12.2.3 through 12.2.15 promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to mitigate this and other vulnerabilities. No alternative mitigations or workarounds are specified in the advisory.