## Summary
Oracle Demand Signal Repository (component: Internal Operations) in Oracle E-Business Suite is affected by CVE-2026-83429. The issue affects supported versions 12.2.3 through 12.2.15 and is described as easily exploitable by a low-privileged attacker with network access via HTTP.
Successful exploitation may enable unauthorized creation, deletion, or modification of critical data, as well as unauthorized access to critical data or complete access to all data accessible through Oracle Demand Signal Repository.
## Technical Details
- Attack vector: NETWORK via HTTP
- Privileges required: low privileged attacker (PR:L)
- User interaction: none (UI:N)
- Complexity: low (AC:L)
- Impact scope: unchanged (S:U)
- Confidentiality impact: high (C:H)
- Integrity impact: high (I:H)
- Availability impact: none (A:N)
## Affected
- Oracle E-Business Suite — Oracle Demand Signal Repository (Internal Operations)
- Affected versions: 12.2.3 to 12.2.15
## Impact
- Unauthorized creation, deletion, or modification of critical data in Oracle Demand Signal Repository
- Unauthorized access to critical data or complete access to all Oracle Demand Signal Repository accessible data
## Mitigation
1. Restrict HTTP network access to Oracle Demand Signal Repository to only trusted sources (e.g., internal networks / allowlisted hosts).
2. Apply Oracle vendor guidance/patches for the affected Oracle E-Business Suite versions (12.2.3–12.2.15) as soon as available.
3. Monitor for anomalous requests to Oracle Demand Signal Repository endpoints from low-privileged clients, focusing on unexpected create/delete/modify activity (exact indicators not provided in the available material).
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N