CVE-2026-83490 is a vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Internal Operations) affecting versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise Oracle iRecruitment, potentially resulting in unauthorized access to critical data and unauthorized update, insert, or delete operations on accessible data. The vulnerability has a CVSS 3.1 score of 8.5 with network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes 673 security patches across multiple products including Oracle E-Business Suite.

Successful exploitation can lead to unauthorized access to critical data within Oracle iRecruitment and unauthorized modification (update, insert, delete) of some accessible data. The vulnerability affects confidentiality and integrity of data but does not impact availability. The scope of impact may extend beyond Oracle iRecruitment to additional Oracle products due to the nature of the vulnerability.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to affected versions 12.2.3 through 12.2.15 of Oracle E-Business Suite to remediate this vulnerability. Oracle recommends remaining on actively-supported versions and applying security patches without delay to prevent exploitation.