Is CVE-2026-83136 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-83136 being exploited in the wild.

How severe is CVE-2026-83136?

High severity, with a CVSS score of 8.8, published 15 September 2026.

Which products and versions are affected?

Oracle E-Business Suite Spares Management 12.2.3 to 12.2.15.

Is there a fix for CVE-2026-83136?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-83136 attacked?

It is attacked over the network.

Am I affected by CVE-2026-83136?

Check whether you run Oracle E-Business Suite Spares Management at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-83136: Oracle E-Business Suite Spares Management privilege escalation via HTTP

CVE-2026-83136 · Severity: high · CVSS 8.8 · Published 2026-09-15

Oracle Spares Management is a module of E-Business Suite used for inventory and procurement operations. A network-accessible vulnerability allows a low-privileged user to gain complete control over the Spares Management system, potentially exposing or manipulating critical supply chain and inventory data. Attackers can trigger the exploit remotely with minimal authentication, putting organizations at risk of operational disruption and data compromise.

Technologies: Oracle E-Business Suite Spares Management. Vendors: Oracle.

Quick answers

Is CVE-2026-83136 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-83136 being exploited in the wild.
How severe is CVE-2026-83136?: High severity, with a CVSS score of 8.8, published 15 September 2026.
Which products and versions are affected?: Oracle E-Business Suite Spares Management 12.2.3 to 12.2.15.
Is there a fix for CVE-2026-83136?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-83136 attacked?: It is attacked over the network.
Am I affected by CVE-2026-83136?: Check whether you run Oracle E-Business Suite Spares Management at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the Internal Operations component of Oracle E-Business Suite Spares Management (versions 12.2.3 through 12.2.15) and is exploitable via HTTP by a low-privileged attacker with network access. The flaw allows an authenticated user to elevate privileges and achieve complete system compromise, affecting confidentiality, integrity, and availability. No user interaction is required; the attack is straightforward to execute due to low access complexity. The vulnerability has not been observed in active exploitation as of the publication date, but patches or mitigations from Oracle are recommended.

Affected products

Oracle E-Business Suite Spares Management 12.2.3 to 12.2.15

Timeline

2026-09-15: disclosed

References

https://www.oracle.com/security-alerts/cspusep2026.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.