# CVE-2026-83171: Oracle One-to-One Fulfillment data access and denial of service vulnerability in Documents component

Source: https://junglewise.ai/threats/cve-2026-83171-oracle-one-to-one-fulfillment-data-access-and-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-83171 · Severity: high · CVSS 7.1 · Published 2026-09-15

A vulnerability in the Oracle One-to-One Fulfillment module (part of Oracle E-Business Suite) allows a low-privileged network attacker to access sensitive business data and disrupt service availability. One-to-One Fulfillment manages customer order fulfillment and document processing in enterprise resource planning systems. Successful exploitation could expose critical customer or operational data and cause partial service outages, impacting business operations across dependent applications.

Technologies: [Oracle One-To-One Fulfillment](https://junglewise.ai/threats/technologies/one-to-one-fulfillment). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2026-83171 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-83171 being exploited in the wild.

**How severe is CVE-2026-83171?** High severity, with a CVSS score of 7.1, published 15 September 2026.

**Which products and versions are affected?** Oracle One-To-One Fulfillment 12.2.3 to 12.2.15.

**Is there a fix for CVE-2026-83171?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-83171 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-83171?** Check whether you run Oracle One-To-One Fulfillment at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A difficult-to-exploit vulnerability exists in the Documents component of Oracle One-to-One Fulfillment, affecting versions 12.2.3 through 12.2.15. The vulnerability requires a low-privileged attacker with network access via HTTP to exploit, with no user interaction needed. Successful attacks can result in unauthorized read access to all data managed by the One-to-One Fulfillment module and partial denial of service; the vulnerability exhibits scope change, meaning the impact extends beyond the affected component to additional Oracle E-Business Suite products. The exploit complexity is high, mitigating ease of weaponization. Patch availability has not been confirmed in available advisory data.

## Affected products

- Oracle One-to-One Fulfillment 12.2.3 to 12.2.15

## Timeline

- 2026-09-15: disclosed

## References

- [https://www.oracle.com/security-alerts/cspusep2026.html](https://www.oracle.com/security-alerts/cspusep2026.html)

## Related threats

- [Oracle One-to-One Fulfillment cross-site scripting in Admin Console UI](https://junglewise.ai/threats/cve-2026-101697-vulnerability-in-the-oracle-one-to-one-fulfillment-product-of)
- [Oracle E-Business Suite One-to-One Fulfillment UI vulnerability](https://junglewise.ai/threats/cve-2017-3439-oracle-e-business-suite-one-to-one-fulfillment-ui-vulnerability)
- [Oracle One-to-One Fulfillment vulnerability in User Interface](https://junglewise.ai/threats/cve-2017-3438-oracle-one-to-one-fulfillment-vulnerability-in-user-interface)
- [Oracle E-Business Suite One-to-One Fulfillment vulnerability in User Interface](https://junglewise.ai/threats/cve-2017-3437-oracle-e-business-suite-one-to-one-fulfillment-vulnerability-in)
- [Oracle One-to-One Fulfillment unauthorized data access in User Interface](https://junglewise.ai/threats/cve-2017-3436-oracle-one-to-one-fulfillment-unauthorized-data-access-in-user)