CVE-2026-83167

Executive Summary

CVE-2026-83167 is an unauthenticated, network-reachable information disclosure vulnerability in the Core component of the Oracle Application Object Library within Oracle E-Business Suite (EBS), affecting supported versions 12.2.3 through 12.2.15. An attacker with only network access to the EBS HTTP interface can trigger the flaw without credentials, resulting in unauthorized access to critical data or complete access to all Application Object Library-accessible data. With a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), no public PoC, no Nuclei template, no exploit code, and no patch evidence from tracked sources, the risk profile is dominated by exposure and detectability rather than immediate known weaponization.

Technical Analysis

Oracle Application Object Library (often abbreviated AOL/FND in the EBS schema namespace) is the shared foundation layer of Oracle E-Business Suite. It provides the common runtime primitives that every EBS module — financials, HR, supply chain, CRM — depends upon: user and responsibility administration, concurrent manager and request submission, menu and function security, session management, and a substantial set of shared Java servlets, JSPs, and PL/SQL packages exposed through the Apache/Oracle HTTP Server (the "OA_HTML" web tier) fronting the Oracle Application Server / WebLogic deployment.

The NVD description states unambiguously that the component is Core, that the attack vector is HTTP over the network, and that exploitation is unauthenticated (PR:N) with no user interaction (UI:N). The impact is confined to confidentiality (C:H/I:N/A:N), meaning the flaw yields data exposure rather than code execution, data destruction, or service outage within the CVSS scope. The phrase "unauthorized access to critical data or complete access to all Oracle Application Object Library accessible data" indicates that the accessible data set is the totality of what AOL itself mediates — in an EBS context this can include authentication metadata, user and responsibility mappings, session identifiers, configuration values, and the records of any business function reachable through AOL's own access-control layer.

At the vulnerability-class level, the deterministic combination of PR:N, AV:N, AC:L, and a confidentiality-only impact is characteristic of an access-control / authentication enforcement defect — typically a missing or bypassable authorization check on an HTTP-reachable endpoint (CWE-306 / CWE-284 class). The precise mechanism (whether the defect lies in a servlet, a JSP, a PL/SQL entry point, or a session-handling routine) is not disclosed in the available data. No function names, class names, URL paths, parameters, or request formats were provided by the CNA or NVD, and this report deliberately does not fabricate any. What can be asserted from the data is the attack surface: any HTTP listener that fronts the AOL Core component for versions 12.2.3–12.2.15 is in scope, and the pre-authentication reachability means the usual EBS login gate is not an effective control against this vulnerability.

Two properties raise the analytic severity above the nominal 7.5. First, AOL is a trust anchor: data leaked from AOL is not merely data — it is the metadata that governs access to everything else. Second, unauthenticated, low-complexity, network-reachable disclosure flaws in internet-exposed enterprise ERP are prioritized by both opportunistic scanners and ransomware-adjacent initial-access brokers, because they require no credentials to validate and no user to be tricked.

No CWE was supplied, no OSV package mapping was provided, and no affected-version list beyond the NVD statement was published. Those gaps are recorded as gaps, not filled.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code exists for CVE-2026-83167. The following chain is inferred from the vulnerability class (unauthenticated, network-reachable information disclosure in a web-exposed application component) and from the NVD description alone. No specific endpoints, parameters, function names, or payload strings are asserted, because none were disclosed in the source data.

1) Reconnaissance and target identification. An attacker enumerates internet-facing hosts that present an Oracle E-Business Suite web tier. EBS deployments are recognizable by the login pages and web-tier paths served by the Oracle HTTP Server front end and by TLS certificate metadata identifying the organization's Oracle infrastructure. Because the flaw requires only network reachability to the HTTP interface (AV:N), the attacker does not need to be inside the corporate network or on a VPN — a public-facing EBS login page is a sufficient candidate.

2) Triggering the flaw. With no credentials and no user interaction required (PR:N, UI:N, AC:L), the attacker sends requests to the AOL Core component's HTTP interface. By class, the exploitation primitive is a request to an endpoint whose access-control or authentication enforcement is missing or bypassable, such that the response is served to an unauthenticated caller. The attacker's work is primarily discovery — locating which request paths within the AOL surface are reachable without a valid session — after which a single low-complexity request is sufficient. Because the flaw is deterministic (AC:L), successful discovery translates directly to repeatable exploitation across every affected instance.

3) Data extraction. Successful triggering yields responses containing data the caller is not entitled to: "critical data" or the complete set of data accessible through the Application Object Library. By class, this is a read primitive — extraction is accomplished by issuing requests and capturing responses, not by injecting code or escalating to write access (I:N, A:N). An attacker would harvest whatever the AOL layer mediates, iterating requests to broaden coverage.

4) Post-exploitation impact. The disclosed data becomes the input to the next stage: AOL-mediated metadata (identities, responsibility and role mappings, session or configuration material) is directly useful for lateral movement into the authenticated portions of EBS, for targeted phishing against named employees, for mapping the organization's ERP footprint, and for extortion leverage if the data set includes regulated records reachable through AOL access paths. The CVSS scope is unchanged (S:U), so the attacker does not gain execution or denial-of-service capability from this CVE alone — but the confidentiality loss is total within the AOL scope (C:H).

Defensive caveat: because no PoC or template is public, exploitation in the wild cannot be confirmed from this CVE record. Detection should target anomalous unauthenticated request patterns against the EBS web tier rather than known malicious payload signatures, which do not exist.

Impact Assessment

The blast radius is defined by the AOL component's role as a shared foundation service: every EBS module in the 12.2.3–12.2.15 range that relies on AOL for access control inherits the exposure. Organizations running internet-exposed EBS instances are the primary at-risk population; air-gapped or strictly internal deployments face a materially lower but non-zero risk, since AV:N with AC:L means any host with a network path to the HTTP listener qualifies.

Subscore interpretation:

• AV:N — exploitable across network boundaries; no local access required. Expands the attacker population from insider to global.
• AC:L — no race condition, no specialized conditions, no unusual configuration. Exploitation is repeatable and automatable, which makes mass scanning economically rational even without a public PoC.
• PR:N — no credentials required. The standard EBS authentication gate is not a mitigating control against this vulnerability.
• UI:N — no victim interaction; the flaw is triggered entirely by the attacker.
• S:U — impact stays within the AOL security authority; no cross-boundary privilege escalation is claimed by the vector.
• C:H — total loss of confidentiality within scope. The NVD language ("complete access to all Oracle Application Object Library accessible data") indicates the ceiling of exposure is the full accessible data set, not a subset.
• I:N / A:N — no integrity or availability impact, so this is a disclosure-only risk. That is cold comfort for ERP operators: the data AOL mediates is precisely the data whose disclosure is most damaging and least recoverable, since disclosure cannot be "rolled back."

Business impact concentrates in four areas: (1) direct data breach exposure for regulated records reachable through AOL, triggering notification and reporting obligations; (2) access-control metadata compromise, which degrades the trustworthiness of EBS authorization decisions and enables downstream authenticated attacks; (3) regulatory and audit exposure for organizations subject to SOX, GDPR, HIPAA, or the like; and (4) attack-surface confirmation — a responder's discovery that this CVE is exploitable on their instance also tells them their EBS web tier is globally reachable, which is itself a finding.

Because CISA KEV listing is absent and EPSS has not yet been scored by FIRST.org, there is no empirical signal of active exploitation. This report does not assert any. The absence of a KEV entry and the absence of a public PoC should be weighed against the fact that unauthenticated, low-complexity, high-confidentiality flaws in internet-facing ERP are high-value targets for initial-access brokers regardless of whether a public exploit exists at time of writing.

Detection Guidance

Detection for this CVE is necessarily behavioral: there are no public payloads, no Nuclei template, and therefore no known request signatures. The following rules target the class-level signature of unauthenticated enumeration and anomalous access against the Oracle E-Business Suite web tier. They should be tuned to the organization's normal EBS request profile before production deployment, and they are more likely to produce false positives in environments with heavy unauthenticated traffic (public login pages, health checks) than signature-based rules would.

Sigma Rule

title: Oracle E-Business Suite AOL Unauthenticated Access Attempt (CVE-2026-83167)
id: 7f3c1e2a-9d44-4b7e-a1c6-2e5f8b0d4a91
status: experimental
description: Detects anomalous unauthenticated HTTP requests against the Oracle E-Business Suite web tier in the class of access-control bypass affecting Application Object Library Core (CVE-2026-83167). Behavioral detection only - no public PoC or payload signature exists.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-83167
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026-83167
logsource:
  category: webserver
  product: oracle_http_server
detection:
  selection_aol_paths:
    cs-uri-stem|contains:
      - '/OA_HTML/'
      - '/OA_MEDIA/'
      - '/fnd/'
  selection_unauthenticated:
    sc-status: 200
    cs-cookie|contains: 'NONE'
  filter_authorized:
    cs-username|exists: true
  condition: selection_aol_paths and selection_unauthenticated and not filter_authorized
falsepositives:
  - Legitimate public login and static asset requests on unauthenticated EBS landing pages
  - Health checks and synthetic monitoring against the EBS web tier
level: medium

Note on rule tuning: the cs-uri-stem values above are the conventional EBS web-tier path families (/OA_HTML/, /fnd/) and are included as environmental scaffolding, not as endpoints asserted by the CVE. Verify them against your own deployment's access logs before enabling. The rule's detection value is in the correlation of an unauthenticated success status with AOL-path requests, not in the path strings themselves.

YARA Rule

rule CVE_2026_83167_Oracle_EBS_AOL_Exploit_Attempt
{
    meta:
        description = "Detects HTTP request artifacts targeting Oracle E-Business Suite Application Object Library Core in the class of CVE-2026-83167. No public PoC exists; this rule targets class-level request structure, not a known payload."
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-83167"
        date = "2026-01-01"
        severity = "high"

    strings:
        $ebs_ok   = "Oracle E-Business Suite" ascii nocase
        $aol_ok   = "Application Object Library" ascii nocase
        $oahl     = "/OA_HTML/" ascii nocase
        $fnd      = "/fnd/" ascii nocase
        $req_get  = "GET " ascii
        $req_post = "POST " ascii

    condition:
        filesize < 2MB and
        ( $ebs_ok or $aol_ok ) and
        ( $oahl or $fnd ) and
        ( $req_get or $req_post )
}

Deployment guidance: run this YARA rule against web access logs, WAF capture files, and PCAP-extracted HTTP streams — not against binaries. It is a triage filter for request artifacts referencing EBS/AOL surfaces, not a malware signature. Because no exploit code is public, there is no byte-level payload to match.

Suricata IDS Rule

alert http any any -> $HOME_NET any ( \
  msg:"CVE-2026-83167 Possible Oracle EBS AOL Unauthenticated Access - Class-Level Detection"; \
  flow:established,to_server; \
  http.method; content:"GET"; \
  http.uri; content:"/OA_HTML/"; nocase; \
  http.header; content:"!Cookie"; \
  threshold: type both, track by_src, count 20, seconds 60; \
  classtype:attempted-recon; \
  sid:8316701; rev:1; \
  reference:cve,2026-83167; \
  reference:url,nvd.nist.gov/vuln/detail/CVE-2026-83167; \
  metadata:created_at 2026_01_01, updated_at 2026_01_01; \
)

Tuning guidance: the /OA_HTML/ URI fragment is the conventional EBS web-tier namespace and must be confirmed against the target deployment. The !Cookie header match detects requests lacking any session cookie, which is the network-observable proxy for the unauthenticated (PR:N) condition. The threshold clause suppresses single-shot noise from crawlers and monitors; raise or lower based on observed baseline. This rule will fire on legitimate unauthenticated access to public EBS landing pages — treat alerts as leads requiring analyst triage, not as confirmed exploitation.

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where
      http.request.method == "GET" and
      http.response.status_code == 200 and
      url.path : ("/OA_HTML/*", "/fnd/*") and
      not http.request.headers.cookie : "*"
  ]
  [ network where
      http.request.method == "GET" and
      http.response.status_code == 200 and
      url.path : ("/OA_HTML/*", "/fnd/*") and
      not http.request.headers.cookie : "*"
  ]

Detection intent: two or more unauthenticated, successful requests to AOL-family paths from the same source within five minutes indicates enumeration behavior rather than incidental public-page access. Single-request noise is suppressed by the sequence requirement. Requires HTTP transaction logging (Packetbeat, Zeek http.log ingested into Elastic, or a WAF feeding the cluster) and that url.path is a parsed field in the target index — adjust field names to match your schema.

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=bluecoat
| eval uri=coalesce(uri, cs_uri_stem, url)
| eval src=coalesce(clientip, src_ip, c_ip)
| eval status=coalesce(status, sc_status, sc_status_code)
| where match(uri, "(?i)/(OA_HTML|OA_MEDIA|fnd)/")
| where status=200
| eval has_session_cookie=if(isnotnull(cookie) AND match(cookie, "(?i)JSESSIONID|ORA_|EBS_|FND_"), 1, 0)
| where has_session_cookie=0
| bin _time span=5m
| stats count AS unauth_aol_hits, dc(uri) AS distinct_paths, values(uri) AS paths_hit BY src, _time
| where unauth_aol_hits >= 10 OR distinct_paths >= 5
| sort - unauth_aol_hits

Detection intent: baseline the rate of successful, cookie-less requests to AOL-family paths per source. The threshold constants (10 hits, 5 distinct paths) are starting points, not tuned values — calibrate against your environment. The has_session_cookie evaluation assumes the proxy or web server logs the Cookie header; where it does not, this control layer is unavailable and the query degrades to path-and-status frequency analysis.

Wazuh OSSEC Rule

<group name="oracle_ebs,web,attack,cve_2026_83167">
  <rule id="831670" level="3">
    <if_sid>31100,31101,31108</if_sid>
    <match>/OA_HTML/</match>
    <description>Oracle EBS web-tier access to AOL path detected</description>
  </rule>

  <rule id="831671" level="8">
    <if_sid>831670</if_sid>
    <regex>^(?!.*(?:JSESSIONID|ORA_|EBS_|FND_)).*200</regex>
    <description>Possible CVE-2026-83167: unauthenticated successful access to Oracle EBS AOL path</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_83167,</group>
  </rule>

  <rule id="831672" level="11" frequency="10" timeframe="120">
    <if_matched_sid>831671</if_matched_sid>
    <same_source_ip />
    <description>Probable CVE-2026-83167 exploitation: sustained unauthenticated AOL path enumeration from single source</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_83167,</group>
  </rule>
</group>

Deployment guidance: the parent rule IDs (31100, 31101, 31108) reference standard Apache/web-server decoders and must be verified against your Wazuh decoder set. Both the path fragment and the cookie-exclusion regex require confirmation against actual EBS access-log formats, which vary by web-tier version and proxy configuration. Rule 831672 (the frequency-based escalation) is the operationally actionable alert; 831670 and 831671 are enrichment tiers.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. No vendor fix, no workaround, and no affected-version list beyond the NVD statement were provided. CVE-2026-83167 is not listed in CISA KEV. The guidance below is therefore risk-reduction, not remediation, and must be re-evaluated the moment Oracle publishes an out-of-cycle or quarterly CPU (Critical Patch Update) advisory referencing this CVE. Treat the absence of a patch as a standing finding to be re-checked on a defined cadence, not a settled conclusion.

1) Immediate mitigations (compensating controls, deploy now):

• Remove internet exposure. The single highest-leverage control. Because the flaw is unauthenticated and network-reachable, placing the EBS web tier behind VPN, zero-trust access proxy, or IP allow-listing directly eliminates the exposure path for the vast majority of threat actors. This does not remediate the vulnerability; it removes the attack surface.
• WAF virtual patching. Deploy rules blocking unauthenticated access to AOL-family paths from outside expected clients, using the path families referenced in the detection rules above (/OA_HTML/, /fnd/). Validate in log-only mode first to avoid breaking legitimate EBS functionality. WAF rules are a stopgap and must not be treated as a fix.
• Enable and centralize full HTTP transaction logging at the web tier and proxy, then deploy the detection rules in this report. Detection is the operator's primary compensating capability while the flaw remains unpatched and unpatchable.
• Reduce the accessible data set. Where feasible, restrict which business data is reachable through AOL-mediated functions for internet-exposed deployments, minimizing the blast radius should the flaw be exploited.
• Isolate EBS network segments so that compromise of the web tier does not provide a network foothold adjacent to backend database or administrative segments.

2) Patch / upgrade steps:

• No patch is available. Do not fabricate or assume one. Monitor Oracle's Critical Patch Update advisories and the Oracle E-Business Suite security alert channel directly at oracle.com/security-alerts; subscribe to Oracle's security notification mailing list so CPU announcements arrive without delay.
• When a CPU addressing CVE-2026-83167 is published: inventory all EBS 12.2.3–12.2.15 instances (including non-production and DR environments, which are commonly forgotten and commonly exposed), validate against a staging instance, apply within the standard emergency-change window, and verify that the specific component (Application Object Library / Core) is covered — do not assume a cumulative update addresses every CVE it nominally spans.
• Because AOL upgrades can require coordinated application-tier and database-tier steps, engage the EBS DBA and applications team early rather than treating the patch as a routine OS-level update.

3) Long-term hardening:

• Establish a recurring EBS exposure review: enumerate every listener that fronts EBS, confirm each is intentionally public, and decommission or gate the rest. Most EBS breaches begin with an internet-facing instance nobody remembered was internet-facing.
• Adopt defense-in-depth around AOL: enforce strong session management, monitor for anomalous authentication and authorization event patterns in EBS audit logs, and alert on unexpected administrative actions.
• Feed this CVE into threat modeling exercises: unauthenticated disclosure flaws in foundation components (authentication, session, access-control metadata) warrant higher enterprise priority than their nominal CVSS score suggests, because disclosed metadata degrades the integrity of every downstream authorization decision.
• Maintain a written patch-watch runbook for unpatched, high-confidentiality ERP CVEs so that the organization has a rehearsed compensating-control procedure ready to execute the moment a future advisory arrives.

References

1. NVD — CVE-2026-83167: https://nvd.nist.gov/vuln/detail/CVE-2026-83167 — primary record; CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
2. Oracle Critical Patch Updates and Security Alerts: https://www.oracle.com/security-alerts/ — authoritative source for the patch status of this CVE. Organizational advisory for CVE-2026-83167 was not available at time of writing; this reference is the channel through which any future fix will be published.
3. Oracle E-Business Suite documentation / support: https://support.oracle.com/ — My Oracle Support for EBS 12.2.x patching and version-specific guidance (support contract required).
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-83167 is NOT listed as of the date of this report. Re-check this catalog on a recurring basis; KEV listing is the strongest open-source signal of active exploitation.
5. FIRST EPSS: https://www.first.org/epss/ — not yet scored for this CVE at time of writing. Do not rely on a fabricated EPSS value; query the API directly for the current score before making prioritization decisions.

Threat actor campaigns / exploit-in-the-wild evidence: none. No public PoC, no Nuclei template, no exploit code, and no CISA KEV listing exist for CVE-2026-83167. No attribution to any threat actor is made or implied. Any claim of exploitation in the wild for this CVE should be treated as unverified until corroborated by a vendor advisory, a government source, or credible incident reporting.

Report produced for valtersit.com. Technical claims are limited to those derivable from the supplied NVD description and CVE metadata; where source data was absent (CWE, PoC, patch, EPSS), that absence is recorded rather than filled with inference.