This vulnerability in Oracle Depot Repair (component: Estimate and Actual Charges) allows an attacker with low privileges and network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Depot Repair. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. The affected versions are 12.2.3 through 12.2.15. Oracle’s September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 patches across multiple products. Oracle strongly recommends applying these patches without delay to prevent exploitation.

Exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Depot Repair. This compromises confidentiality and integrity of the affected system’s data. There is no reported impact on availability. The vulnerability is exploitable remotely over the network with low complexity and requires only low privileges, increasing the risk of compromise if unpatched.

Oracle has released a Critical Security Patch Update in September 2026 that includes a fix for CVE-2026-83432. Customers should apply the official patch promptly to remediate this vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory; patching is the primary remediation.