## Summary
CVE-2026-83329 is a vulnerability in Oracle Applications Framework (component: Personalization) within Oracle E-Business Suite. A low-privileged attacker with network access via HTTP can exploit it, potentially leading to takeover of Oracle Applications Framework.
## Technical Details
- Affected component: Personalization within Oracle Applications Framework (Oracle E-Business Suite).
- Attack vector: NETWORK via HTTP.
- Exploitability: described as “easily exploitable” with PR:L (low privileges) and AC:L (low complexity).
- Impact scope: S:U (unchanged scope), with high impacts to C:H, I:H, and A:H.
- CVSS 3.1: 8.8 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
## Affected
- Oracle E-Business Suite / Oracle Applications Framework (Personalization): versions 12.2.9 through 12.2.15 (inclusive).
## Impact
- Takeover of Oracle Applications Framework.
- High likelihood of compromise resulting in Confidentiality, Integrity, and Availability impact (C:H, I:H, A:H).
## Mitigation
1. Patch immediately to the vendor-fixed Oracle E-Business Suite / Oracle Applications Framework version for the Personalization component (exact fixed version not provided in the available data).
2. Restrict HTTP access to Oracle E-Business Suite/Applications Framework endpoints to trusted networks and users only.
3. Reduce privileges for accounts that can reach the vulnerable surface (since exploitation requires PR:L).
4. Monitor for anomalous requests to Personalization-related functionality over HTTP and investigate suspicious session activity consistent with framework takeover.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H