CVE-2026-83465 is a vulnerability in the Oracle Mobile Application Server component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It allows an unauthenticated attacker with network access via HTTP to cause a hang or repeated crash (denial of service) and unauthorized update, insert, or delete access to some data accessible by the server. Exploitation requires user interaction from a person other than the attacker and can affect additional products beyond the Oracle Mobile Application Server due to scope change. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:H, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, no confidentiality impact, low integrity impact, and high availability impact.

Successful exploitation can lead to denial of service conditions causing the Oracle Mobile Application Server to hang or crash repeatedly, disrupting availability. Additionally, attackers can gain unauthorized ability to update, insert, or delete some data accessible by the server, impacting data integrity. There is no confidentiality impact reported. The vulnerability may also affect other products due to scope change.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to affected versions (12.2.3 through 12.2.15) of Oracle Mobile Application Server. No indication of 'no action required' or 'already mitigated' is present; therefore, patching is the recommended remediation.