CVE-2026-83173 is a vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite, specifically in the Documents component. It affects supported versions 12.2.3 through 12.2.15. The flaw allows a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized access to critical or all accessible data and the ability to cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 7.1 with high confidentiality impact and low availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes targeted patches for this and many other vulnerabilities.

Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle One-to-One Fulfillment and partial denial of service conditions. The attacker requires only low privileges and network access via HTTP. The confidentiality impact is high, while availability impact is low. There is no integrity impact reported.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly to affected versions 12.2.3 through 12.2.15 of Oracle E-Business Suite to remediate this vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified.