---
id: "CVE-2026-83370"
kind: "vulnerability"
aliases: ["CVE-2026-83370"]
title: "Oracle E-Business Suite Sourcing Auctions flaw lets low-privileged users take over"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["enterprise-apps", "oracle-ebs", "self-hosted", "sourcing", "vendor"]
not_affected_if: ["not-ebs-12.2.3-12.2.15", "sourcing-not-used"]
published_at: "2026-10-20T22:19:53+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-25T03:18:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83370", "first_seen_at": "2026-10-23T21:57:25+00:00"}]
---

# Oracle E-Business Suite Sourcing Auctions flaw lets low-privileged users take over

Oracle E-Business Suite's Sourcing product, in its Auctions component, has a flaw reachable over HTTP by a low-privileged user. Successful exploitation can lead to full takeover of Sourcing, with high confidentiality, integrity and availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the Oracle E-Business Suite release in use: `unknown` from the sources beyond the affected range
- Check whether the Sourcing (Auctions) module is installed and in use: unknown

## Fix

- Apply the Oracle Critical Patch Update fix for Sourcing (Auctions) in E-Business Suite 12.2.3 through 12.2.15: unknown patch number in the sources

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-83370

## From the sources

Vulnerability in the Sourcing product of Oracle E-Business Suite (component: Auctions).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Sourcing.  Successful attacks of this vulnerability can result in takeover of Sourcing. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_