Is CVE-2026-83173 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-83173 being exploited in the wild.

How severe is CVE-2026-83173?

High severity, with a CVSS score of 7.1, published 15 September 2026.

Which products and versions are affected?

Oracle E-Business Suite One-to-One Fulfillment 12.2.3-12.2.15.

Is there a fix for CVE-2026-83173?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-83173 attacked?

It is attacked over the network.

Am I affected by CVE-2026-83173?

Check whether you run Oracle E-Business Suite One-to-One Fulfillment at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-83173: Oracle E-Business Suite One-to-One Fulfillment authentication bypass in Documents

CVE-2026-83173 · Severity: high · CVSS 7.1 · Published 2026-09-15

Oracle E-Business Suite's One-to-One Fulfillment module is used to manage customer orders and document workflows in enterprise procurement systems. A vulnerability allows an authenticated user with network access to bypass authorization controls and access sensitive order and customer data, or cause partial service disruption. This could expose confidential business information and disrupt order fulfillment operations.

Technologies: Oracle E-Business Suite One-to-One Fulfillment. Vendors: Oracle.

Quick answers

Is CVE-2026-83173 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-83173 being exploited in the wild.
How severe is CVE-2026-83173?: High severity, with a CVSS score of 7.1, published 15 September 2026.
Which products and versions are affected?: Oracle E-Business Suite One-to-One Fulfillment 12.2.3-12.2.15.
Is there a fix for CVE-2026-83173?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-83173 attacked?: It is attacked over the network.
Am I affected by CVE-2026-83173?: Check whether you run Oracle E-Business Suite One-to-One Fulfillment at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A logic flaw in the Documents component of Oracle One-to-One Fulfillment allows a low-privileged, authenticated user to escalate access and retrieve critical data beyond their authorization scope. The vulnerability is network-reachable via HTTP and requires valid user credentials but no additional user interaction. An attacker can read sensitive data across the fulfillment system and potentially degrade availability of the service. Oracle has assigned CVSS 3.1 score 7.1 (High) reflecting the combination of high confidentiality impact and partial availability impact. Patches are expected from Oracle's September 2026 security update cycle.

Affected products

Oracle E-Business Suite One-to-One Fulfillment 12.2.3-12.2.15

Timeline

2026-09-15: disclosed
2026-09-15: advisory: Oracle CPU September 2026

References

https://www.oracle.com/security-alerts/cspusep2026.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.