{"id":"CVE-2026-83386","kind":"vulnerability","aliases":["CVE-2026-83386"],"related":[],"title":"Oracle E-Business Suite HRMS: low-privilege users can read HR data","description":"Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (US).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle HRMS (US) accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","summary":"Oracle HRMS (US) in E-Business Suite releases 12.2.3 through 12.2.15 has a flaw in its Internal Operations component. A low-privileged user with network access over HTTP can gain unauthorized access to HR data the product holds.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hrms","oracle-ebs","self-hosted","vendor"],"not_affected_if":["unknown"],"how_to_check":"- Confirm the E-Business Suite release in use is within `12.2.3` to `12.2.15`\n- Check whether the HRMS (US) product is installed and reachable over HTTP\n- Review Oracle's advisory for the patch level that covers this CVE: unknown","fix":"- Apply the Oracle Critical Patch Update that addresses CVE-2026-83386 for the E-Business Suite HRMS (US) product; the exact patch name is unknown\n- Move to a release outside `12.2.3` to `12.2.15` if a patch is not available: unknown","status":"open","published_at":"2026-10-20T22:19:54+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T03:51:32+00:00","updated_at":"2026-10-25T03:51:32+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T03:51:32Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update that addresses CVE-2026-83386 for the E-Business Suite HRMS (US) product; the exact patch name is unknown\n- Move to a release outside `12.2.3` to `12.2.15` if a patch is not available: unknown","reach":"network","title":"Oracle E-Business Suite HRMS: low-privilege users can read HR data","impact":"medium","summary":"Oracle HRMS (US) in E-Business Suite releases 12.2.3 through 12.2.15 has a flaw in its Internal Operations component. A low-privileged user with network access over HTTP can gain unauthorized access to HR data the product holds.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","hrms","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Unauthorized read of HR data, with complete access to HRMS data","analyst_note":"Find the Oracle Critical Patch Update advisory and patch name covering CVE-2026-83386, and confirm the affected release range against Oracle's advisory.","how_to_check":"- Confirm the E-Business Suite release in use is within `12.2.3` to `12.2.15`\n- Check whether the HRMS (US) product is installed and reachable over HTTP\n- Review Oracle's advisory for the patch level that covers this CVE: unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organisations running Oracle E-Business Suite HRMS (US) on releases 12.2.3 through 12.2.15 that expose it to users over HTTP. The sources do not describe a specific configuration; reachable low-privileged accounts are the exposure path.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000666,"input_tokens":3466,"output_tokens":638,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-83386':17A,20A '/av':144C '12.2.15':40B,92C '12.2.3':38B,91C '3.1':134C,143C '6.5':137C 'access':56B,62B,102C,119C,125C,131C 'affect':89C 'allow':96C 'attack':99C,111C 'base':135C 'busi':4A,35B,80C 'complet':124C 'compon':48B,82C 'compromis':106C 'confidenti':138C 'critic':121C 'cve':15A,18A 'cvss':133C,140C,142C 'data':14A,65B,122C,132C 'e':3A,34B,79C 'e-busi':2A,33B,78C 'easili':93C 'eb':24B 'exploit':94C 'flaw':43B 'gain':60B 'h/i':150C 'hold':68B 'host':27B 'hr':13A,64B 'hrms':6A,21B,30B,73C,108C,129C 'http':58B,104C 'impact':139C 'intern':46B,83C 'l/pr':146C 'l/ui':147C 'low':8A,51B,97C 'low-privileg':7A,50B 'n':152C 'n/a':151C 'n/ac':145C 'n/s':148C 'network':55B,101C 'oper':47B,84C 'oracl':1A,23B,29B,72C,77C,107C,128C 'oracle-eb':22B 'privileg':9A,52B,98C 'product':67B,75C 'read':12A 'releas':37B 'result':116C 'score':136C 'self':26B 'self-host':25B 'success':110C 'suit':5A,36B,81C 'support':85C 'u/c':149C 'unauthor':61B,118C 'us':31B,74C,109C,130C 'user':10A,53B 'vector':141C 'vendor':28B 'version':86C 'via':103C 'vulner':69C,95C,114C","nicknames":[],"mitigations":[],"who_affected":"Organisations running Oracle E-Business Suite HRMS (US) on releases 12.2.3 through 12.2.15 that expose it to users over HTTP. The sources do not describe a specific configuration; reachable low-privileged accounts are the exposure path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:19:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-83386","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83386","severity":null,"published_at":"2026-10-20T22:19:54+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}