CVE-2026-83167 is a vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core) affecting supported versions 12.2.3 through 12.2.15. The flaw allows an unauthenticated attacker with network access via HTTP to compromise the Oracle Application Object Library, resulting in unauthorized access to critical data. The CVSS 3.1 base score is 7.5, with the vector indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact. Oracle's September 2026 Critical Security Patch Update includes patches for this vulnerability among 673 security fixes across multiple products.

Successful exploitation of this vulnerability can lead to unauthorized access to critical data or complete access to all data accessible via the Oracle Application Object Library component. The confidentiality of sensitive information is at high risk. There is no reported impact on integrity or availability. No known exploits in the wild have been reported as of the advisory date.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these security patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or temporary fixes are indicated in the advisory.