CVE-2026-83432 is a vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite, component Estimate and Actual Charges. It affects versions 12.2.3 to 12.2.15. The vulnerability is exploitable by a low-privileged attacker over the network via HTTP without user interaction. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Depot Repair. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N with a base score of 8.1, reflecting high confidentiality and integrity impacts but no availability impact. Oracle has released a Critical Security Patch Update in September 2026 addressing this and many other vulnerabilities, strongly recommending customers apply patches promptly.

The vulnerability allows an attacker with low privileges and network access to compromise Oracle Depot Repair data integrity and confidentiality. This includes unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by the product. There is no reported impact on availability. The high CVSS score reflects the significant risk to data confidentiality and integrity.

Oracle has released a Critical Security Patch Update in September 2026 that includes fixes for this vulnerability. Customers are strongly advised to apply the available patches without delay to mitigate the risk. Oracle recommends remaining on actively supported versions and promptly applying security patches. No additional mitigation steps are specified beyond applying the official patch.