{"id":"CVE-2026-83370","kind":"vulnerability","aliases":["CVE-2026-83370"],"related":[],"title":"Oracle E-Business Suite Sourcing Auctions flaw lets low-privileged users take over","description":"Vulnerability in the Sourcing product of Oracle E-Business Suite (component: Auctions).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Sourcing.  Successful attacks of this vulnerability can result in takeover of Sourcing. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle E-Business Suite's Sourcing product, in its Auctions component, has a flaw reachable over HTTP by a low-privileged user. Successful exploitation can lead to full takeover of Sourcing, with high confidentiality, integrity and availability impact.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise-apps","oracle-ebs","self-hosted","sourcing","vendor"],"not_affected_if":["not-ebs-12.2.3-12.2.15","sourcing-not-used"],"how_to_check":"- Confirm the Oracle E-Business Suite release in use: `unknown` from the sources beyond the affected range\n- Check whether the Sourcing (Auctions) module is installed and in use: unknown","fix":"- Apply the Oracle Critical Patch Update fix for Sourcing (Auctions) in E-Business Suite 12.2.3 through 12.2.15: unknown patch number in the sources","status":"open","published_at":"2026-10-20T22:19:53+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T03:18:53+00:00","updated_at":"2026-10-25T03:18:53+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:18:53Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Sourcing (Auctions) in E-Business Suite 12.2.3 through 12.2.15: unknown patch number in the sources","reach":"internet","title":"Oracle E-Business Suite Sourcing Auctions flaw lets low-privileged users take over","impact":"high","summary":"Oracle E-Business Suite's Sourcing product, in its Auctions component, has a flaw reachable over HTTP by a low-privileged user. Successful exploitation can lead to full takeover of Sourcing, with high confidentiality, integrity and availability impact.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","sourcing","self-hosted","enterprise-apps"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over the Sourcing application with high impact","analyst_note":"Find Oracle's Critical Patch Update advisory for the Sourcing Auctions fix and the patch number for 12.2.3 through 12.2.15; the NVD entry lacks it.","how_to_check":"- Confirm the Oracle E-Business Suite release in use: `unknown` from the sources beyond the affected range\n- Check whether the Sourcing (Auctions) module is installed and in use: unknown","needs_analyst":true,"not_affected_if":["not-ebs-12.2.3-12.2.15","sourcing-not-used"],"who_is_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Sourcing Auctions component in use. Teams not running that release or not using Sourcing can skip it. The sources do not describe the exact exposed configuration.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000658,"input_tokens":3431,"output_tokens":629,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-83370':17A,20A '/av':134C '12.2.15':92C '12.2.3':91C '3.1':121C,133C '7.5':124C 'access':103C 'affect':89C 'allow':97C 'app':23B 'attack':100C,110C 'auction':7A,42B,84C 'avail':70B,128C 'base':122C 'busi':4A,35B,81C 'compon':43B,83C 'compromis':107C 'confidenti':67B,125C 'cve':15A,18A 'cvss':120C,130C,132C 'difficult':93C 'e':3A,34B,80C 'e-busi':2A,33B,79C 'eb':26B 'enterpris':22B 'enterprise-app':21B 'exploit':57B,95C 'flaw':8A,46B 'full':61B 'h':142C 'h/a':141C 'h/i':140C 'h/pr':136C 'high':66B 'host':29B 'http':49B,105C 'impact':71B,129C 'integr':68B,126C 'l/ui':137C 'lead':59B 'let':9A 'low':11A,53B,98C 'low-privileg':10A,52B 'n/ac':135C 'n/s':138C 'network':102C 'oracl':1A,25B,32B,78C 'oracle-eb':24B 'privileg':12A,54B,99C 'product':39B,76C 'reachabl':47B 'result':115C 'score':123C 'self':28B 'self-host':27B 'sourc':6A,30B,38B,64B,75C,108C,119C 'success':56B,109C 'suit':5A,36B,82C 'support':85C 'take':14A 'takeov':62B,117C 'u/c':139C 'user':13A,55B 'vector':131C 'vendor':31B 'version':86C 'via':104C 'vulner':72C,96C,113C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Sourcing Auctions component in use. Teams not running that release or not using Sourcing can skip it. The sources do not describe the exact exposed configuration.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:19:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-83370","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83370","severity":null,"published_at":"2026-10-20T22:19:53+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}