CVE-2026-83338 is a vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite, specifically in the Oracle Diagnostics Interfaces component. It affects supported versions 12.2.3 through 12.2.15. The flaw is easily exploitable by an attacker with low privileges and network access via HTTP, potentially allowing full compromise of Oracle Applications Manager. The vulnerability is rated with a CVSS 3.1 base score of 8.8, reflecting high impact on confidentiality, integrity, and availability. Oracle's September 2026 Critical Security Patch Update includes patches that address this vulnerability among 673 others.

Successful exploitation of this vulnerability can lead to complete takeover of the Oracle Applications Manager, compromising confidentiality, integrity, and availability of the affected system. This could allow attackers to execute unauthorized actions within Oracle Applications Manager, potentially affecting the broader Oracle E-Business Suite environment.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle recommends remaining on actively-supported versions and applying security patches without delay. No additional mitigation steps beyond patching are indicated by the vendor advisory.