Threat Intelligence Database

CVE-2026-83128 is a vulnerability in Oracle Sales Offline, part of Oracle E-Business Suite. It affects versions 12.2.3 through 12.2.15 and allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with a significant confidentiality impact. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides patches for affected versions.

CVE-2026-83127 is a vulnerability in Oracle Sales Offline, part of Oracle E-Business Suite Internal Operations, affecting versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to unauthorized access to critical data or full access to all data accessible by Oracle Sales Offline. The vulnerability has a CVSS 3.1 base score of 7.7, indicating high severity with significant confidentiality impact. The vulnerability also has scope change potential, possibly impacting additional Oracle products. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides targeted security fixes. Customers are strongly advised to apply the available patches promptly to mitigate the risk.

Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Sales Offline. While the vulnerability is in Oracle Sales Offline, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Sales Offline. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).

Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Offline. Successful attacks of this vulnerability can result in takeover of Oracle Sales Offline. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).