CVE-2026-83128 is a vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite, specifically in the Internal Operations component. It affects supported versions 12.2.3 through 12.2.15. The flaw allows an unauthenticated attacker with network access via HTTP to compromise Oracle Sales Offline, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact without integrity or availability impact. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update.

Successful exploitation of this vulnerability can lead to unauthorized access to critical data or complete access to all data accessible through Oracle Sales Offline. The confidentiality of sensitive information is at high risk. There is no reported impact on integrity or availability. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Security Patch Update in September 2026 that includes a fix for this vulnerability. Customers should apply the relevant patches from this update without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to prevent exploitation. No additional mitigation steps are indicated by the vendor advisory.