CVE-2026-83171 is a vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite, specifically in the Documents component. It affects versions 12.2.3 through 12.2.15. The flaw allows a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized access to critical data and the ability to cause a partial denial of service. The vulnerability has a CVSS 3.1 score of 7.1, with confidentiality impact rated high and availability impact rated low. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update advisory.

Successful exploitation can lead to unauthorized access to critical data within Oracle One-to-One Fulfillment and partial denial of service conditions. The vulnerability's scope change means attacks may also significantly impact additional Oracle products. The attack complexity is high, requiring network access and low privileges, with no user interaction needed.

Oracle has released a fix for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively-supported versions and applying security patches without delay. No additional mitigation steps are indicated beyond applying the official patch.