# CVE-2026-83084: Oracle E-Business Suite Marketing unauthorized data access in Audience component

Source: https://junglewise.ai/threats/cve-2026-83084-oracle-e-business-suite-marketing-unauthorized-data-access-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-83084 · Severity: high · CVSS 7.7 · Published 2026-09-15

Oracle E-Business Suite includes a Marketing module with an Audience management component that has a vulnerability allowing low-privileged users to gain unauthorized access to sensitive customer data. An attacker with basic network access and limited user credentials can exploit this flaw to view confidential information that the Marketing application manages, potentially exposing customer records and business-critical data across connected systems.

Technologies: [Oracle E-Business Suite Marketing](https://junglewise.ai/threats/technologies/e-business-suite-marketing). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2026-83084 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-83084 being exploited in the wild.

**How severe is CVE-2026-83084?** High severity, with a CVSS score of 7.7, published 15 September 2026.

**Which products and versions are affected?** Oracle E-Business Suite Marketing 12.2.3–12.2.15.

**Is there a fix for CVE-2026-83084?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-83084 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-83084?** Check whether you run Oracle E-Business Suite Marketing at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a confidentiality vulnerability in the Audience component of Oracle E-Business Suite Marketing (versions 12.2.3–12.2.15). The vulnerability is easily exploitable and requires only low privileges and network access via HTTP; no user interaction is needed. An authenticated attacker can bypass authorization controls to access critical or all data managed by Oracle Marketing. Although the vulnerability exists in Marketing, its impact extends beyond that product (scope change), potentially compromising additional connected E-Business Suite components. The CVSS 3.1 score of 7.7 reflects high confidentiality impact with no integrity or availability impact.

## Affected products

- Oracle E-Business Suite Marketing 12.2.3–12.2.15

## Timeline

- 2026-09-15: disclosed

## References

- [https://www.oracle.com/security-alerts/cspusep2026.html](https://www.oracle.com/security-alerts/cspusep2026.html)

## Related threats

- [Oracle Marketing unauthenticated access in E-Business Suite](https://junglewise.ai/threats/cve-2026-101640-vulnerability-in-the-oracle-marketing-product-of-oracle-e)
- [Oracle E-Business Suite Marketing cross-site request forgery in Audience](https://junglewise.ai/threats/cve-2026-101639-vulnerability-in-the-oracle-marketing-product-of-oracle-e)
- [Oracle E-Business Suite Marketing privilege escalation in Audience component](https://junglewise.ai/threats/cve-2026-83121-oracle-e-business-suite-marketing-privilege-escalation-in)
- [Oracle E-Business Suite Marketing privilege escalation in Audience component](https://junglewise.ai/threats/cve-2026-83083-oracle-e-business-suite-marketing-privilege-escalation-in)
- [Oracle E-Business Suite Marketing Audience privilege escalation](https://junglewise.ai/threats/cve-2026-83082-oracle-e-business-suite-marketing-audience-privilege-escalation)