CVE-2026-83084

Executive Summary

CVE-2026-83084 is a high-severity information disclosure and access control vulnerability (CWE-284) in the Audience component of Oracle Marketing, part of Oracle E-Business Suite (EBS). It affects supported versions 12.2.3 through 12.2.15 and is remotely exploitable over HTTP by a low-privileged attacker. Successful exploitation results in unauthorized access to critical data or complete access to all Oracle Marketing-accessible data, with a scope change indicating potential lateral impact to additional products.

Technical Analysis

The vulnerability resides in the Audience component of Oracle Marketing. Oracle's advisory classifies it under CWE-284 (Improper Access Control), and the NVD description confirms an "easily exploitable" flaw allowing a low-privileged attacker with network access via HTTP to compromise Oracle Marketing. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) indicates:

• Attack Vector: Network (remote HTTP access)
• Attack Complexity: Low (no specialized conditions or race windows)
• Privileges Required: Low (any authenticated low-privilege EBS user)
• User Interaction: None (no victim action needed)
• Scope: Changed (impact extends beyond the vulnerable Oracle Marketing component)
• Confidentiality: High (full read access to Marketing-accessible data)
• Integrity: None
• Availability: None

No specific function names, API paths, or parameter names are disclosed in the NVD description or CNA title. Accordingly, the precise code-level mechanism (e.g., missing authorization check on a specific Audience data endpoint) cannot be reconstructed from available data. What is observable is that the flaw class is improper access control (broken authorization / privilege boundary enforcement) within an HTTP-reachable Oracle Marketing module. The scope change (S:C) implies the compromised Audience functionality can be leveraged to access resources outside the immediate component boundary — a characteristic of authorization bypasses where a low-privilege context is used to read data belonging to higher-privilege or adjacent modules. No public PoC, Nuclei template, or exploit code is available. EPSS has not been scored by FIRST.org. CISA KEV does not list this CVE. Patch confidence is 0/4 — no patch evidence from tracked sources.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred at the vulnerability-class level (improper access control over HTTP), using only details present in the NVD description.

1. Reconnaissance / Target Identification: The attacker identifies an internet- or intranet-facing Oracle E-Business Suite deployment running Oracle Marketing (versions 12.2.3-12.2.15). EBS login pages and Marketing application paths are reachable over HTTP(S). The attacker obtains valid low-privileged credentials — via default accounts, credential stuffing, phishing, or legitimate low-privilege access (e.g., self-service user).

2. Trigger of the Flaw: Using the low-privileged authenticated session, the attacker interacts with the Audience component of Oracle Marketing. Because access control on the affected functionality is improperly enforced, requests that should be denied to a low-privilege user are instead processed. The exact malformed or crafted request cannot be specified from available data; at the class level, this is a broken authorization condition in which the application fails to verify that the requester is entitled to the requested Audience data or operation.

3. Execution Method: The attacker sends crafted HTTP requests over the network with their low-privileged session. Because UI interaction is None and complexity is Low, no victim is required and no race condition or special timing is needed. The requests succeed and return unauthorized content.

4. Post-Exploitation Impact: The attacker gains unauthorized access to critical data or complete access to all data accessible through Oracle Marketing. Due to scope change (S:C), the impact can extend to additional products — meaning the authorization context obtained through Oracle Marketing may permit access to data or functionality beyond that component. Integrity and availability are unaffected per the CVSS vector, so the primary impact is confidential data theft and potential follow-on targeting based on disclosed information.

Impact Assessment

Business impact is high for confidentiality. Oracle E-Business Suite commonly holds financial, customer, order, pricing, and marketing campaign data; Oracle Marketing specifically may expose contact lists, segmentation data, customer attributes, and campaign records that constitute regulated PII or commercially sensitive information. The CVSS base score of 7.7 reflects High confidentiality impact under a changed scope. Because privileges required are Low and no user interaction is needed, any authenticated low-privilege user with network reachability can exploit it — a large attacker population inside enterprise networks and any internet-exposed EBS instance. Blast radius is extended by the scope change: data beyond Oracle Marketing may be reachable, per the NVD statement that attacks "may significantly impact additional products." Integrity and availability are not impacted, so the attacker cannot directly alter or destroy records through this flaw; however, harvested data may enable further attacks (e.g., targeted phishing using disclosed contact data, or reconnaissance for privilege escalation). No exploit-in-the-wild evidence, KEV listing, or public PoC is available, indicating no confirmed active exploitation at this time.

Detection Guidance

Note: Because no endpoint, parameter, or function names are disclosed, the following rules use class-level and product-level heuristics (Oracle Marketing / Audience access patterns, anomalous data-volume responses, and EBS HTTP telemetry) rather than exact exploit signatures. Tune field names, indices, and thresholds to your environment.

Sigma Rule

title: Potential Oracle E-Business Suite Marketing Audience Access Control Abuse (CVE-2026-83084)
id: 8f2a1c94-3d7e-4b21-9c5a-4e6b7f0a1d33
status: experimental
description: Detects anomalous access to Oracle Marketing Audience functionality by low-privileged sessions, consistent with improper access control exploitation attempts against Oracle E-Business Suite (CVE-2026-83084).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-83084
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: oracle
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/OA_HTML/'
      - '/Marketing'
      - '/Audience'
  selection_method:
    cs-method:
      - 'GET'
      - 'POST'
  selection_status:
    sc-status:
      - 200
      - 500
  filter_static:
    cs-uri-stem|endswith:
      - '.css'
      - '.js'
      - '.png'
      - '.gif'
      - '.ico'
  condition: selection_path and selection_method and selection_status and not filter_static
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - sc-status
falsepositives:
  - Legitimate Marketing/Audience user activity
  - Automated reporting jobs
level: medium
tags:
  - attack.t1190
  - cve.2026-83084

YARA Rule

rule CVE_2026_83084_Oracle_Marketing_Audience_Access
{
    meta:
        description = "Heuristic detection of Oracle Marketing Audience access-control exploitation artifacts (CVE-2026-83084) in HTTP request/response captures or web logs."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-83084"
        date = "2026-01-01"
        severity = "high"

    strings:
        $marketing = "Oracle Marketing" nocase ascii wide
        $audience  = "Audience" nocase ascii wide
        $ebs_oa    = "/OA_HTML/" nocase ascii wide
        $mkt_path  = "/Marketing" nocase ascii wide
        $aud_path  = "/Audience" nocase ascii wide
        $httpget   = "GET " ascii
        $httppost  = "POST " ascii
        $cookie    = "Set-Cookie" nocase ascii

    condition:
        (uint16(0) == 0x4854 or uint16(0) == 0x4F50 or filesize > 0) and
        ($httpget or $httppost) and
        ($ebs_oa or $mkt_path or $aud_path) and
        ($audience or $marketing) and
        $cookie
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-83084 Oracle E-Business Suite Marketing Audience Access Control Abuse Attempt"; flow:established,to_server; http.method; content:"GET"; http.method; content:"POST"; http.uri; content:"/OA_HTML/"; http.uri; content:"Audience"; http.uri; content:"Marketing"; classtype:attempted-user; reference:cve,2026-83084; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-83084; sid:90083084; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, confidence Low;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ http where http.request.method in ("GET","POST") and
      wildcard(http.request.path, "/OA_HTML/*") ]
  [ http where http.response.status_code == 200 and
      wildcard(http.request.path, "*Audience*") and
      http.response.body.bytes > 100000 ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=oracle_ebs
| search uri_path IN ("*OA_HTML*", "*Marketing*", "*Audience*")
| eval is_mkt=if(match(uri_path, "(?i)marketing|audience"), 1, 0)
| where is_mkt=1
| stats count AS req_count, sum(bytes) AS total_bytes, values(status) AS statuses,
        dc(uri_path) AS distinct_paths BY src_ip, user
| where req_count > 50 OR total_bytes > 5000000
| sort - total_bytes
| table src_ip, user, req_count, distinct_paths, total_bytes, statuses

Wazuh OSSEC Rule

<group name="oracle_ebs,web,cve-2026-83084">
  <rule id="100830" level="6">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">/OA_HTML/</field>
    <field name="url">Marketing</field>
    <description>CVE-2026-83084: Possible Oracle E-Business Suite Marketing Audience access (low-privilege).</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="100831" level="10">
    <if_sid>100830</if_sid>
    <field name="url">Audience</field>
    <field name="id">200</field>
    <description>CVE-2026-83084: Successful access to Oracle Marketing Audience data - possible improper access control exploitation.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="100832" level="12" frequency="20" timeframe="120">
    <if_matched_sid>100831</if_matched_sid>
    <same_source_ip/>
    <description>CVE-2026-83084: High-volume Oracle Marketing Audience access from single source - probable data harvesting.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

• Restrict network access to Oracle E-Business Suite and Oracle Marketing. Do not expose EBS directly to the internet; require VPN or zero-trust access.
• Apply network segmentation and WAF rules to restrict access to the Audience component of Oracle Marketing to authorized roles only.
• Reduce the low-privilege account attack surface: enforce least privilege, disable unused accounts, and audit all accounts with Marketing/Audience access.
• Monitor and rate-limit high-volume Audience/Marketing data requests per user and source IP (see Splunk/Wazuh rules above).

2. Patch / Upgrade Steps:

• No patch is confirmed by any tracked source. Monitor Oracle's Critical Patch Update (CPU) and Security Alerts for the official fix. Oracle publishes EBS patches via My Oracle Support (MOS) as "Critical Patch Update" advisories and typically documents CVSS vectors in its CPU advisory.
• Until a fix is released, treat the affected 12.2.3-12.2.15 range as vulnerable and rely on compensating controls above.
• When released, apply the Oracle CPU patch for Oracle Marketing (Audience) across all affected EBS 12.2.x instances.

3. Long-Term Hardening:

• Maintain EBS on the latest CPU level and subscribe to Oracle Security Alerts.
• Enforce strong authentication (MFA) and Just-In-Time privileged access.
• Implement centralized logging and SIEM alerting for the detection logic above.
• Conduct regular access reviews for Oracle Marketing and associated modules.
• Validate that scope change (S:C) implications are addressed by segregating Marketing data-at-rest and limiting cross-module data access.

References

• NVD — CVE-2026-83084: https://nvd.nist.gov/vuln/detail/CVE-2026-83084
• Oracle Critical Patch Updates and Security Alerts: https://www.oracle.com/security-alerts/
• Oracle E-Business Suite (My Oracle Support) — vendor patch channel (advisory not yet published for this CVE per current data)
• FIRST.org EPSS — not yet scored for CVE-2026-83084
• CISA Known Exploited Vulnerabilities Catalog — CVE-2026-83084 not listed (no exploit-in-the-wild evidence)

Threat actor campaigns / exploit-in-the-wild: None reported. No public PoC, Nuclei template, or exploit code is available for CVE-2026-83084.