CVE-2026-83152 is a vulnerability in Oracle Project Intelligence within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Project Intelligence. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact without availability impact.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Project Intelligence, or unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of sensitive data managed by Oracle Project Intelligence. There are no reported known exploits in the wild at this time.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to affected Oracle E-Business Suite versions 12.2.3 through 12.2.15. Oracle recommends remaining on actively supported versions and applying security patches without delay to mitigate this vulnerability.