CVE-2026-83169 Privilege escalation in Oracle One-to-One Fulfillment
Unauthenticated attackers can escalate privileges to take over Oracle One-to-One Fulfillment via HTTP, requiring immediate patching.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-83169?
CVE-2026-83169 is a high-severity vulnerability in Oracle One-to-One Fulfillment, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Java Server Issues). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Successful attacks of this vulnerability can result in takeover of Oracle One-to-One Fulfillment. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Weakness: CWE-269
Which versions are affected by CVE-2026-83169?
How do I fix CVE-2026-83169?
No fix has been published for CVE-2026-83169 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-83169 being exploited?
There is no known exploitation of CVE-2026-83169 in the wild and no public exploit code.
Sources
Also known as GHSA-jq4x-mhpp-3rq9.