CVE-2026-83172 in Sales Online
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Sales Online product of Oracle E-Business Suite (component: OSO Other). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Online. While the vulnerability is in Oracle Sales Online, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Sales Online accessible data as well as unauthorized update, insert or delete access to some of Oracle Sales Online accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Oracle Sales Online component of the Oracle E-Business Suite, specifically affecting supported versions ranging from 12.2.3 through 12.2.15. This security flaw represents a significant risk to organizations relying on this enterprise resource planning platform for managing customer relationships and sales operations. The core issue stems from an authentication bypass or insufficient access control mechanism that allows low-privileged attackers, who possess valid network credentials but lack administrative rights, to exploit the system via standard HTTP protocols. Unlike high-severity vulnerabilities requiring complex exploitation chains or user interaction, this flaw is easily exploitable without any need for social engineering or graphical user interface interactions, making it particularly dangerous in automated attack scenarios where threat actors can script repeated attempts against exposed endpoints.
The technical nature of this vulnerability aligns with CWE-287, which describes Improper Authentication, and potentially CWE-915, Improper Control of Dynamically-Identified Variables, depending on the specific implementation details within the application logic. The attacker leverages network access to send crafted requests that bypass standard authorization checks, effectively elevating their privileges beyond what was originally granted by the system administrator. This capability allows the adversary to interact with sensitive modules of the Oracle Sales Online environment as if they were a higher-privileged user or an unauthenticated entity in certain contexts. The absence of required UI interaction means that once network connectivity is established and valid credentials are obtained, often through phishing or credential stuffing attacks, the exploitation can proceed immediately without further engagement from legitimate users.
The operational impact of this vulnerability extends far beyond the immediate boundaries of the Oracle Sales Online module due to a scope change characteristic inherent in many integrated enterprise suites. While the flaw originates within the sales component, successful exploitation enables unauthorized access to critical data across interconnected systems and databases that share authentication contexts or underlying storage structures. This lateral movement capability means that compromising this single entry point can lead to a broader compromise of the entire E-Business Suite environment. The confidentiality impact is rated as high because attackers can extract sensitive customer information, proprietary sales strategies, pricing models, and personal identifiable data stored within the system. Simultaneously, the integrity impact is significant, allowing adversaries to perform unauthorized updates, insertions, or deletions of records. This capability threatens the accuracy and reliability of business operations, potentially leading to financial loss, regulatory non-compliance with standards such as GDPR or CCPA due to data leakage, and reputational damage resulting from manipulated transactional data.
From a threat intelligence perspective, this vulnerability maps directly to MITRE ATT&CK technique T1078, Valid Accounts, where attackers use legitimate credentials to gain access, combined with techniques related to Data Staged for Exfiltration or Impact via Data Manipulation. The high base CVSS score of 8.5 reflects the combination of network accessibility, low complexity, and the severe consequences regarding data confidentiality and integrity. Organizations must recognize that this is not merely an isolated application bug but a systemic risk affecting the broader ecosystem managed by Oracle E-Business Suite.
Mitigation strategies should prioritize immediate patching to the latest available version within the 12.2.x line if it addresses this specific flaw, as vendor patches are typically designed to close these authentication and authorization gaps. In environments where patching is not immediately feasible due to operational constraints, network segmentation becomes critical. Administrators should restrict HTTP access to Oracle Sales Online endpoints to only trusted IP ranges or internal subnets that do not expose the service directly to untrusted networks like the public internet. Additionally, implementing strict Web Application Firewall rules can help detect and block anomalous request patterns associated with exploitation attempts. Multi-factor authentication should be enforced for all user accounts accessing these systems to mitigate the risk of credential compromise leading to unauthorized access. Regular auditing of user permissions is also essential to ensure that low-privileged users do not possess excessive rights, thereby reducing the blast radius if an account is compromised. Continuous monitoring for unusual data access patterns or bulk deletions can aid in early detection of active exploitation attempts.