CVE-2026-83164 is a vulnerability in the Oracle Customer Interaction History product within Oracle E-Business Suite (component: Outcome-Result). It affects versions 12.2.3 through 12.2.15. The flaw is easily exploitable by an attacker with low privileges and network access via HTTP, allowing compromise and takeover of the affected component. The vulnerability has a CVSS 3.1 base score of 8.8, reflecting high impact across confidentiality, integrity, and availability. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update, which contains 673 security patches across multiple Oracle products. Oracle strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation of this vulnerability can lead to complete takeover of the Oracle Customer Interaction History component, impacting confidentiality, integrity, and availability of the system. This could allow attackers to access sensitive data, modify or disrupt system operations. The vulnerability is exploitable remotely over the network with low privileges and no user interaction required, increasing its risk.

Oracle has released an official fix for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers running affected versions (12.2.3 through 12.2.15) should apply the relevant patches promptly to remediate the vulnerability. Oracle strongly advises remaining on actively supported versions and applying security patches without delay. No additional mitigation steps are indicated beyond applying the official patch.