## Summary
CVE-2026-83425 is a vulnerability in Oracle Complex Maintenance, Repair and Overhaul (component: Internal Operations) within Oracle E-Business Suite. A low-privileged attacker with network access via HTTP can exploit it to gain unauthorized access to sensitive data and potentially cause partial denial of service.
## Technical Details
- Affected component: Internal Operations in Oracle Complex Maintenance, Repair and Overhaul.
- Attack vector: NETWORK over HTTP.
- Exploitability: described as “easily exploitable” with PR:L (low privileges) and UI:N (no user interaction).
- Impact scope: S:C indicates the impact can extend beyond the vulnerable component to additional products.
- Likely outcomes include:
- Unauthorized access to critical data
- Complete access to all Oracle Complex Maintenance, Repair and Overhaul accessible data
- Partial denial of service (partial DOS)
## Affected
- Oracle E-Business Suite – Oracle Complex Maintenance, Repair and Overhaul (Internal Operations): 12.2.12 through 12.2.15 (inclusive).
## Impact
- Confidentiality: C:H (high)
- Availability: A:L (low)
- Integrity: I:N (none)
- Overall severity: high, with CVSS 3.1 base score 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L).
## Mitigation
1. Patch immediately: apply the vendor’s security fix for Oracle E-Business Suite / Oracle Complex Maintenance, Repair and Overhaul (Internal Operations) covering versions 12.2.12–12.2.15.
2. Restrict network access to the affected HTTP endpoints/services to trusted networks only.
3. Review and harden access controls for low-privileged accounts, since exploitation requires PR:L.
4. Monitor for anomalous behavior consistent with unauthorized access attempts and partial service disruption.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L