CVE-2026-83161 in Project Intelligence
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Project Intelligence product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Intelligence. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Project Intelligence accessible data as well as unauthorized read access to a subset of Oracle Project Intelligence accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Internal Operations component of Oracle Project Intelligence, a module integral to the broader Oracle E-Business Suite ecosystem. This specific flaw affects supported software versions ranging from 12.2.3 through 12.2.15, indicating that a significant portion of deployed enterprise environments remain susceptible if they have not yet applied relevant security patches or migrated to newer releases. The nature of this vulnerability is particularly concerning because it allows for exploitation by an attacker with low privileges who possesses network access via the HTTP protocol. This implies that the attack vector does not require high-level administrative credentials or complex social engineering tactics, but rather relies on standard web-based interactions that a lower-tier user might legitimately perform, thereby lowering the barrier to entry for malicious actors targeting these systems.
From a technical perspective, the flaw enables unauthorized creation, deletion, modification, and read access to critical data within Oracle Project Intelligence. The ability to modify or delete data points directly to integrity violations, while the capacity to create new entries suggests potential privilege escalation or injection of false records that could distort business intelligence outputs. Furthermore, the vulnerability permits unauthorized read access to a subset of accessible data, which constitutes a confidentiality breach. This dual impact on both integrity and confidentiality aligns with common patterns seen in insecure direct object references or improper authorization checks within web applications where input validation or session management is insufficiently enforced for specific internal operations endpoints.
The operational impact of this vulnerability is substantial due to the critical nature of project intelligence data, which often includes financial projections, resource allocation details, and strategic business metrics. An attacker successfully exploiting this flaw could manipulate key performance indicators, alter budgetary constraints, or exfiltrate sensitive corporate information without detection by standard security monitoring tools that may not flag low-privilege user actions as anomalous. The CVSS 3.1 base score of 7.1 reflects a high severity level driven primarily by the high integrity impact and moderate confidentiality impact. The vector string AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N confirms that while availability is not directly compromised, the potential for data tampering poses a severe risk to organizational trust and regulatory compliance.
In terms of industry standard classification, this vulnerability maps closely to CWE-269 Improper Privilege Management or CWE-862 Missing Authorization, as it allows low-privileged users to perform actions beyond their intended scope. Additionally, the exploitation method involving HTTP-based attacks on internal operations may correlate with MITRE ATT&CK techniques such as T1078 Valid Accounts if the attacker uses legitimate but insufficiently restricted credentials, or potentially T1190 Exploit Public-Facing Application depending on how the HTTP interface is exposed and configured. Organizations must recognize that even low-privilege accounts can serve as a pivot point for deeper system compromise if internal application logic fails to enforce strict separation of duties and data access controls.
Mitigation strategies should prioritize immediate patching by applying the latest security updates provided by Oracle for versions 12.2.3 through 12.2.15, ensuring that all instances are brought up to a version where this flaw has been remediated. In environments where patching is not immediately feasible, network segmentation and strict firewall rules should be implemented to restrict HTTP access to the Internal Operations component exclusively from trusted internal subnets, thereby reducing the attack surface for external or lateral movement attempts. Additionally, implementing robust Web Application Firewall policies can help detect and block anomalous request patterns associated with data manipulation attacks. Regular auditing of user permissions within Oracle E-Business Suite is also recommended to ensure that low-privilege accounts do not possess unnecessary access rights to sensitive project intelligence modules, adhering to the principle of least privilege.