CVE-2026-83159 is a vulnerability in the Applications DBA product of Oracle E-Business Suite, specifically in the ADPatch component. It affects versions 12.2.3 through 12.2.15. The flaw allows an unauthenticated attacker who has logon access to the underlying infrastructure to compromise Applications DBA, with successful exploitation requiring human interaction from a user other than the attacker. The CVSS 3.1 vector indicates local attack vector, low complexity, no privileges required, but user interaction is needed, and the impact is high on confidentiality, integrity, and availability. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among others.

Successful exploitation can lead to full takeover of the Applications DBA product, impacting confidentiality, integrity, and availability of the affected system. The attack requires local access (logon to infrastructure) and user interaction from a third party, which limits remote exploitation but still poses a significant risk in environments where attackers can gain such access.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the available security patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying patches without delay. No additional mitigation steps are specified beyond applying the official patch.