CVE-2026-83175 is a vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core) affecting supported versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the Oracle Application Object Library, resulting in unauthorized access to critical data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N with a base score of 6.5. Oracle has released security patches as part of the September 2026 Critical Security Patch Update to address this and many other vulnerabilities.

Successful exploitation of this vulnerability can lead to unauthorized access to critical data within the Oracle Application Object Library. The confidentiality impact is high, while integrity and availability are not affected. The vulnerability requires low attack complexity and low privileges but no user interaction, and it is exploitable remotely via network HTTP access.

Oracle has released patches for this vulnerability in the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these security patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying patches without delay. No alternative mitigations or temporary fixes are indicated in the advisory.