Description
Vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite (component: Outcome-Result). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Customer Interaction History. Successful attacks of this vulnerability can result in takeover of Oracle Customer Interaction History. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-09-15
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Application Compromise
Action: Immediate Patch
AI Analysis

Impact

The Oracle Customer Interaction History component named Outcome‑Result contains a flaw that permits an attacker with low privileges to exploit the application over HTTP. The vulnerability allows unauthorized access that can lead to a complete takeover of the application, compromising confidentiality, integrity, and availability.

Affected Systems

Oracle Corporation’s Oracle Customer Interaction History, part of Oracle E‑Business Suite, is affected in releases 12.2.3 through 12.2.15. No other vendors or products are listed as impacted.

Risk and Exploitability

The CVSS base score of 8.8 reflects high impact. EPSS less than 1% indicates rare current exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers require only low privileges and HTTP network access; no user interaction is needed, making the flaw remotely reachable when the component is exposed to the network.

Generated by OpenCVE AI on September 17, 2026 at 02:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch or upgrade to a version outside the affected range.
  • Restrict HTTP access to the Oracle Customer Interaction History component to trusted networks using IP‑based firewall rules or network segmentation.
  • Verify and enforce proper authentication and authorization checks on the Outcome‑Result component to prevent unauthorized access.

Generated by OpenCVE AI on September 17, 2026 at 02:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 03:00:00 +0000

Type Values Removed Values Added
Title Access Control Bypass via HTTP in Oracle Customer Interaction History
Weaknesses CWE-269
CWE-284

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite (component: Outcome-Result). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Customer Interaction History. Successful attacks of this vulnerability can result in takeover of Oracle Customer Interaction History. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle customer Interaction History
CPEs cpe:2.3:a:oracle:customer_interaction_history:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle customer Interaction History
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Customer Interaction History
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-15T20:03:42.928Z

Reserved: 2026-08-31T15:40:57.343Z

Link: CVE-2026-83164

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:27.340

Modified: 2026-09-16T19:36:43.087

Link: CVE-2026-83164

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T02:45:18Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-284

    Improper Access Control