Description
Vulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Applications Calendar). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Common Applications Calendar. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Common Applications Calendar accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Common Applications Calendar. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).
Published: 2026-09-15
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data modification and partial denial of service
Action: Immediate Patch
AI Analysis

Impact

Vulnerability in the Oracle Common Applications Calendar component of Oracle E‑Business Suite permits a low‑privileged attacker with network access through HTTP to create, delete, or modify critical data and optionally cause a partial denial of service. Exploitation results in unauthorized data tampering and availability impact, as described by the CVSS vector. The flaw stems from insufficient access control that allows users without proper credentials to perform prohibited operations.

Affected Systems

Oracle Common Applications Calendar of Oracle E‑Business Suite, versions 12.2.3 through 12.2.15, is affected.

Risk and Exploitability

The CVSS base score of 7.1 indicates moderate to high risk, but the EPSS score of less than 1% suggests exploitation is unlikely at present. The vulnerability is not listed in CISA's KEV catalog. Based on the description, the likely attack vector is HTTP over the network from a low‑privileged account, though final confirmation requires further information.

Generated by OpenCVE AI on September 18, 2026 at 20:19 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle E‑Business Suite patch that addresses this issue
  • Limit HTTP access to the application from trusted networks or hosts using firewall or ACLs
  • Disable or restrict the calendar feature for accounts lacking necessary privileges until a patch is applied

Generated by OpenCVE AI on September 18, 2026 at 20:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title Low‑privileged HTTP Exploit in Oracle Common Applications Calendar Allows Unauthorized Data Modification

Thu, 17 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 22:30:00 +0000

Type Values Removed Values Added
Title Low‑privileged HTTP Exploit in Oracle Common Applications Calendar Allows Unauthorized Data Modification
Weaknesses CWE-284

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Applications Calendar). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Common Applications Calendar. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Common Applications Calendar accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Common Applications Calendar. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).
First Time appeared Oracle
Oracle common Applications Calendar
CPEs cpe:2.3:a:oracle:common_applications_calendar:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle common Applications Calendar
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L'}

Subscriptions

Oracle Common Applications Calendar
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-17T15:15:20.910Z

Reserved: 2026-08-31T15:40:57.345Z

Link: CVE-2026-83186

cve-icon Vulnrichment

Updated: 2026-09-17T14:22:44.973Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:29.803

Modified: 2026-09-17T16:18:08.297

Link: CVE-2026-83186

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-18T20:30:16Z

Weaknesses