# CVE-2026-83194: Oracle Depot Repair privilege escalation via HTTP

Source: https://junglewise.ai/threats/cve-2026-83194-oracle-depot-repair-privilege-escalation-via-http  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-83194 · Severity: high · CVSS 8.8 · Published 2026-09-15

Oracle Depot Repair is a component within Oracle E-Business Suite used for managing equipment repair operations. A network-accessible vulnerability allows a low-privileged user to gain complete control over the Depot Repair system, potentially compromising confidential repair records, operational data, and system integrity across the enterprise.

Technologies: [Oracle E-Business Suite Depot Repair](https://junglewise.ai/threats/technologies/e-business-suite-depot-repair). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2026-83194 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-83194 being exploited in the wild.

**How severe is CVE-2026-83194?** High severity, with a CVSS score of 8.8, published 15 September 2026.

**Which products and versions are affected?** Oracle E-Business Suite Depot Repair 12.2.10-12.2.15.

**Is there a fix for CVE-2026-83194?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-83194 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-83194?** Check whether you run Oracle E-Business Suite Depot Repair at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A network-exploitable vulnerability in Oracle Depot Repair (component: Internal Operations) allows a low-privileged attacker with HTTP access to escalate privileges and achieve full system compromise. The vulnerability requires user authentication but no special interaction, and affects versions 12.2.10 through 12.2.15. Successful exploitation grants the attacker complete confidentiality, integrity, and availability compromise of the Depot Repair module, enabling data exfiltration, operational disruption, or further lateral movement within E-Business Suite. Oracle has issued a security advisory (CSPUSep2026) for this CVE; patch or workaround availability should be verified directly with Oracle support.

## Affected products

- Oracle E-Business Suite Depot Repair 12.2.10-12.2.15

## Timeline

- 2026-09-15: disclosed
- 2026-09-15: advisory: Oracle Security Alert CSPUSep2026

## References

- [https://www.oracle.com/security-alerts/cspusep2026.html](https://www.oracle.com/security-alerts/cspusep2026.html)

## Related threats

- [Oracle Depot Repair unauthorized data access in Recall Management](https://junglewise.ai/threats/cve-2026-83436-oracle-depot-repair-unauthorized-data-access-in-recall-management)
- [Oracle Depot Repair data manipulation in E-Business Suite](https://junglewise.ai/threats/cve-2026-83432-oracle-depot-repair-data-manipulation-in-e-business-suite)