Description
Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Offline. While the vulnerability is in Oracle Sales Offline, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Sales Offline accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
Published: 2026-09-15
Score: 7.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Unrestricted Data Access
Action: Immediate Patch
AI Analysis

Impact

Oracle Sales Offline, part of Oracle E-Business Suite, has a vulnerability that can be exploited via HTTP requests. A low-privileged attacker with network access can gain unauthorized access to all data stored in the Sales Offline application, resulting in confidentiality loss of critical information.

Affected Systems

The affected product is Oracle Sales Offline, included in Oracle E-Business Suite, for supported versions ranging from 12.2.3 through 12.2.15.

Risk and Exploitability

The CVSS v3.1 base score of 7.7 indicates moderate-to-high severity. The EPSS score of less than 1% suggests a low probability of exploitation at this time, and the vulnerability is not listed in CISA KEV. Attackers can exploit the flaw from a network-connected low-privileged user via the HTTP interface; the vulnerability has a scope change, allowing compromise to extend beyond the Sales Offline component.

Generated by OpenCVE AI on September 17, 2026 at 01:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor patch to Oracle Sales Offline to a non-affected version.
  • Upgrade Oracle E-Business Suite to a version that does not contain the vulnerability.
  • Restrict network access to the Sales Offline HTTP endpoint to trusted networks or IP ranges.
  • Implement application-layer access controls to prevent unauthorized data retrieval.
  • Monitor logs for suspicious HTTP activity on the Sales Offline interface.

Generated by OpenCVE AI on September 17, 2026 at 01:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 02:15:00 +0000

Type Values Removed Values Added
Title Data Exposure via HTTP in Oracle Sales Offline
Weaknesses CWE-200

Wed, 16 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Offline. While the vulnerability is in Oracle Sales Offline, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Sales Offline accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
First Time appeared Oracle
Oracle sales Offline
CPEs cpe:2.3:a:oracle:sales_offline:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle sales Offline
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

Oracle Sales Offline
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-16T17:57:35.119Z

Reserved: 2026-08-31T15:40:57.341Z

Link: CVE-2026-83127

cve-icon Vulnrichment

Updated: 2026-09-16T17:56:13.279Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T20:18:23.200

Modified: 2026-09-16T19:40:00.317

Link: CVE-2026-83127

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T02:00:10Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control