CVE-2026-83177 is a vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite, specifically in the Documents component. It affects supported versions 12.2.3 through 12.2.15. The flaw allows a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all accessible data within Oracle One-to-One Fulfillment. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, low privilege required, no user interaction, unchanged scope, and high confidentiality and integrity impact without availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes targeted patches for this and many other vulnerabilities.

Successful exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle One-to-One Fulfillment, or unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of the affected system's data. There is no impact on availability reported. The vulnerability is exploitable remotely over the network with low complexity and requires only low privileges.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers using Oracle One-to-One Fulfillment versions 12.2.3 through 12.2.15 are strongly advised to apply the relevant patches promptly to remediate this vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation. No additional mitigation steps are specified beyond applying the official patches.