Description
Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Java Server Issues). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Successful attacks of this vulnerability can result in takeover of Oracle One-to-One Fulfillment. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-09-15
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution leading to full system takeover
Action: Immediate Patch
AI Analysis

Impact

CVE-2026-83169 is a vulnerability in Oracle One‑to‑One Fulfillment, part of Oracle E‑Business Suite. The flaw resides in the Java Server component and allows an unauthenticated attacker to send crafted HTTP requests that can be leveraged for remote code execution. Successfully exploiting this defect results in compromise of the fulfillment application, with full control of data and processor execution – effectively taking over the entire instance.

Affected Systems

The vulnerability affects Oracle One‑to‑One Fulfillment with supported versions 12.2.3 through 12.2.15. It pertains exclusively to the Java Server handling HTTP traffic for this product; no other vendors or products are affected.

Risk and Exploitability

The CVSS base score of 8.1 classifies the issue as high severity, with confidentiality, integrity and availability all impacted. Attacker requirements are minimal – mere network connectivity to the HTTP interface, no user credentials, and no privileged access. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. However, its remote nature and the magnitude of potential damage warrant immediate remediation.

Generated by OpenCVE AI on September 20, 2026 at 09:14 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle patch that addresses the Java Server issue for Oracle One‑to‑One Fulfillment versions 12.2.3 to 12.2.15.
  • Restrict inbound HTTP access to the Oracle One‑to‑One networks using firewalls or network segmentation to limit attack surface.
  • Configure the service to use HTTPS with strict TLS settings to prevent tampering and eavesdropping on traffic.
  • Enable multi‑factor authentication for any administrative interfaces to mitigate impact if credentials are compromised.

Generated by OpenCVE AI on September 20, 2026 at 09:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Code Execution in Oracle One-to-One Fulfillment via HTTP
Weaknesses CWE-502

Thu, 17 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 17 Sep 2026 01:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Code Execution in Oracle One-to-One Fulfillment via HTTP
Weaknesses CWE-502

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Java Server Issues). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Successful attacks of this vulnerability can result in takeover of Oracle One-to-One Fulfillment. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle one-to-one Fulfillment
CPEs cpe:2.3:a:oracle:one-to-one_fulfillment:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle one-to-one Fulfillment
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle One-to-one Fulfillment
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-17T13:10:43.185Z

Reserved: 2026-08-31T15:40:57.344Z

Link: CVE-2026-83169

cve-icon Vulnrichment

Updated: 2026-09-17T13:02:04.932Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:27.887

Modified: 2026-09-17T14:17:34.937

Link: CVE-2026-83169

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T09:15:17Z

Weaknesses
  • CWE-269

    Improper Privilege Management