CVE-2026-83130 is a vulnerability in Oracle Site Hub within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the application, resulting in unauthorized creation, deletion, or modification of critical data and unauthorized read access to some data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, limited confidentiality impact, high integrity impact, and no availability impact. Oracle has included fixes for this vulnerability in its September 2026 Critical Security Patch Update (CSPU).

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical or all accessible data within Oracle Site Hub, as well as unauthorized read access to a subset of accessible data. This compromises data confidentiality and integrity but does not affect availability. The vulnerability is exploitable remotely over the network with low privileges and no user interaction required.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to remediate the vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or temporary fixes are indicated in the advisory.