Description
Vulnerability in the Oracle Alert product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Alert. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Alert accessible data as well as unauthorized access to critical data or complete access to all Oracle Alert accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-09-15
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Confidentiality and integrity compromise via unauthorized data modification or deletion
Action: Apply Patch
AI Analysis

Impact

Oracle Alert in Oracle E‑Business Suite contains an easily exploitable flaw that allows a low‑privileged attacker with network access via HTTP to create, delete, or modify critical data. Successful exploitation can lead to unauthorized changes to the data stored in Oracle Alert, compromising both confidentiality and integrity. The CVSS vector reflects no availability impact but high confidentiality and integrity effects.

Affected Systems

The affected products are Oracle Alert for Oracle E‑Business Suite, supported versions 12.2.3 through 12.2.15.

Risk and Exploitability

The CVSS 3.1 base score of 8.1 indicates a high severity vulnerability. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not yet listed in CISA’s KEV catalog. The attack vector is network‑based over HTTP and requires the attacker to have low‑privileged credentials within the system, after which they can leverage improper access controls to gain unauthorized modification or deletion rights over Oracle Alert data.

Generated by OpenCVE AI on September 18, 2026 at 21:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Deploy the latest Oracle Alert patch that addresses this vulnerability.
  • Restrict access to the Oracle Alert HTTP interfaces by firewall rules or VPN so only trusted hosts can reach the application.
  • Implement strict role‑based access control and regularly review user permissions to ensure no user has broader privileges than needed.
  • Monitor and log data modification activities within Oracle Alert and investigate any anomalous actions promptly.

Generated by OpenCVE AI on September 18, 2026 at 21:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Alert product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Alert. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Alert accessible data as well as unauthorized access to critical data or complete access to all Oracle Alert accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle alert
CPEs cpe:2.3:a:oracle:alert:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle alert
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Alert
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-17T15:20:24.612Z

Reserved: 2026-08-31T15:40:57.339Z

Link: CVE-2026-83089

cve-icon Vulnrichment

Updated: 2026-09-17T14:59:02.312Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:18.733

Modified: 2026-09-17T16:17:59.710

Link: CVE-2026-83089

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-27T02:30:16Z

Weaknesses