CVE-2026-83436 is a network-exploitable vulnerability in Oracle Depot Repair (Oracle E-Business Suite component Recall Management) versions 12.2.3 to 12.2.15. It allows a low privileged attacker with HTTP network access to compromise the system, resulting in unauthorized access to critical or all accessible data and the ability to cause a partial denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L with a base score of 7.1. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes targeted security fixes for this and many other vulnerabilities. Customers are advised to apply the patches without delay to prevent exploitation.

Successful exploitation of this vulnerability can lead to unauthorized access to critical or all data accessible by Oracle Depot Repair, compromising confidentiality. Additionally, it can cause a partial denial of service affecting availability. There is no impact on integrity reported. The vulnerability requires low privileges and network access via HTTP, making it relatively easy to exploit if unpatched.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply these official patches promptly to remediate the vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the vendor advisory.