## Summary
CVE-2026-83162 is a vulnerability in Oracle Application Object Library (component: Core) within Oracle E-Business Suite. Affected supported versions are 12.2.3 through 12.2.15.
The issue is described as difficult to exploit but allows an unauthenticated attacker with network access via HTTPS to compromise Oracle Application Object Library, potentially enabling unauthorized creation, deletion, or modification of critical data (or all accessible data).
## Technical Details
- Attack scenario (per NVD): an unauthenticated attacker with network access over HTTPS.
- Exploitability: marked as difficult to exploit.
- Privileges required: PR:N (no privileges).
- User interaction: UI:N (none).
- Impact scope: S:U (unchanged scope).
## Affected
- Oracle E-Business Suite — Oracle Application Object Library (Core)
- Affected versions: 12.2.3 to 12.2.15
## Impact
- Confidentiality impact: C:H (high)
- Integrity impact: I:H (high)
- Availability impact: A:N (none)
- Potential outcomes (per NVD):
- Unauthorized creation, deletion, or modification of critical data
- Unauthorized access to critical data or complete access to all Oracle Application Object Library accessible data
## Mitigation
1. Apply the vendor’s recommended patch/upgrade for Oracle E-Business Suite Oracle Application Object Library (Core) covering 12.2.3–12.2.15.
2. Restrict inbound HTTPS access to Oracle E-Business Suite to only trusted networks/clients (reduce exposure for AV:N).
3. Monitor for anomalous unauthenticated requests to Oracle Application Object Library endpoints and investigate suspicious patterns consistent with attempted exploitation.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N