CVE-2026-83187

Executive Summary

CVE-2026-83187 is an easily exploitable vulnerability affecting the Applications Calendar component of Oracle Common Applications Calendar within Oracle E-Business Suite, impacting supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit the flaw to gain unauthorized creation, deletion, or modification access to critical data, along with read access to a subset of accessible data. With a CVSS 3.1 base score of 7.1 (High), the vulnerability is rated primarily for its severe Integrity impact (I:H) and limited Confidentiality impact (C:L), with no Availability impact (A:N) and no user interaction required (UI:N), indicating a straightforward and impactful attack path for any authenticated low-privilege user.

Technical Analysis

CVE-2026-83187 resides in the Applications Calendar component of Oracle Common Applications Calendar, a module within Oracle E-Business Suite (EBS). The affected supported version range is 12.2.3 through 12.2.15, indicating a broad exposure across most modern 12.2.x deployments of EBS. The NVD description does not disclose specific function names, endpoints, API paths, or parameter names, so analysis must remain at the vulnerability-class level.

Based on the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N), the following characteristics are definitive:

• Attack Vector (Network / AV:N): The vulnerability is remotely reachable over the network. The NVD description explicitly states the attack is delivered "via HTTP," placing the vulnerable component behind the web-facing EBS application tier.
• Attack Complexity (Low / AC:L): No specialized conditions, race windows, or pre-existing environmental prerequisites are required. Exploitation is repeatable and deterministic.
• Privileges Required (Low / PR:L): The attacker must hold a valid low-privileged account on the EBS instance. This is significant in enterprise environments where self-registration, supplier portals, or shared low-privilege roles exist. The attacker does not need administrative privileges.
• User Interaction (None / UI:N): No victim user action is needed — the attacker directly triggers the flaw.
• Scope (Unchanged / S:U): The impact is confined to the security authority of the vulnerable component; exploitation does not cross privilege boundaries into other security scopes.
• Confidentiality (Low / C:L): Unauthorized read access to a subset of Application Calendar accessible data.
• Integrity (High / I:H): Unauthorized creation, deletion, or modification access to critical data or all Application Calendar accessible data — the dominant risk factor driving the severity.
• Availability (None / A:N): No disruption to data or service availability is described.

The vulnerability class, given a web-enabled enterprise application with an authenticated low-privilege prerequisite and high integrity impact, is most consistent with CWE-284 (Improper Access Control) or an authorization/broken-access-control weakness in the Applications Calendar. The NVD description notably does not mention SQL injection, remote code execution, deserialization, or memory corruption, and does not describe any execution of arbitrary code or command. The described impact is strictly data-level (create, delete, modify, read). No CWE identifier was provided by NVD.

Because the flaw is exploitable via HTTP by an authenticated low-privilege user, the most probable mechanism is missing or insufficient authorization checks on one or more Applications Calendar operations — allowing a low-privileged actor to invoke data-manipulation operations normally restricted to higher-privileged roles. However, no specific endpoint, function, or parameter can be named from the available data. Any claim of a precise code-level defect would be speculation and is therefore withheld.

No patch evidence exists from any tracked source (Patch Confidence: 0/4), and no public PoC, exploit code, or Nuclei template is available. The EPSS score is 0.00318 (24.7th percentile), indicating that while the vulnerability is theoretically easy to exploit, observed exploitation activity in the wild is currently low-probability relative to the broader corpus. CISA KEV status is NO — no confirmed in-the-wild exploitation.

Exploitation Scenarios

Because no public PoC exists, the attack chain below is inferred strictly from the vulnerability class (improper access control in a web application) and the CVSS metrics provided. No specific function names, endpoints, or parameters are fabricated.

1. Reconnaissance / Target Identification The attacker identifies internet-facing or internally reachable Oracle E-Business Suite instances running versions 12.2.3–12.2.15. Fingerprinting is performed via HTTP responses, login pages, and EBS-specific markers. Shodan or internal scanning can enumerate EBS login endpoints exposed over HTTP/HTTPS. The attacker requires a valid low-privileged account, which may be obtained through legitimate provisioning, self-registration, supplier/partner access, or credential reuse against weak or default accounts.

2. Triggering the Flaw (Vulnerability Class Level) With an authenticated low-privilege session, the attacker sends HTTP requests to the Applications Calendar functionality. Due to insufficient authorization enforcement, the component processes data-manipulation operations that the low-privileged account should not be permitted to perform. The attacker manipulates requests to create, delete, or modify calendar records beyond their entitlement. No specific request structure can be described from the available data.

3. Payload / Execution Method (Vulnerability Class Level) Exploitation is a request-level abuse of broken access control — the attacker reuses their authenticated session and directs operations at the vulnerable component. There is no evidence of code injection, command execution, or memory corruption in the NVD description; the "payload" is a legitimate-looking authorized request that the component fails to properly authorize. This distinguishes it from injection-class vulnerabilities.

4. Post-Exploitation Impact Successful exploitation yields unauthorized integrity impact (create/delete/modify critical data or all Application Calendar accessible data) and limited confidentiality impact (read access to a subset of data). This could enable corruption of scheduling, calendaring, or business-process data, manipulation of records used by downstream EBS modules, and limited information disclosure. The unchanged scope (S:U) and no availability impact (A:N) bound the blast radius to the Applications Calendar data domain and its integrity.

Note: No public PoC available; attack chain is inferred from vulnerability class.

Impact Assessment

Business impact centers on data integrity within the Oracle E-Business Suite Applications Calendar. EBS is a Tier-0 enterprise system for many organizations, handling finance, HR, supply chain, and CRM functions. A High Integrity impact (I:H) means an attacker can create, delete, or modify critical data — including potentially all Application Calendar accessible data — which can corrupt business records, falsify scheduling or workflow data, and undermine trust in EBS data used for downstream decision-making.

Affected systems: Oracle E-Business Suite 12.2.3 through 12.2.15 deployments exposing the Common Applications Calendar / Applications Calendar component with HTTP reachability. Organizations running EBS on-premises, in private cloud, or in managed hosting with network-exposed application tiers are in scope.

Blast radius: Scope is Unchanged (S:U), so the compromise does not automatically propagate across security authorities. However, because EBS modules are highly interconnected, modified calendar data may feed other modules, elevating the effective business impact beyond the immediate component. The Confidentiality impact is Low (C:L) — only a subset of data is readable — which limits direct data exfiltration severity but not the integrity damage.

CVSS subscore interpretation: AV:N (remote), AC:L (no complexity barrier), PR:L (requires account — the primary mitigating factor), UI:N (no victim needed), C:L / I:H / A:N. The EPSS of 0.00318 (24.7th percentile) and absence from CISA KEV suggest low observed exploitation, but the low attack complexity and network reachability mean the risk is non-trivial for unpatched, internet-exposed EBS instances.

Detection Guidance

Sigma Rule

title: Potential Oracle E-Business Suite Applications Calendar Unauthorized Data Modification (CVE-2026-83187)
id: 9f3c1a72-5b84-4e6d-a1c2-cve202683187
status: experimental
description: Detects anomalous modification, creation, or deletion activity targeting Oracle Applications Calendar by low-privileged users, consistent with CVE-2026-83187.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-83187
author: valtersit.com
date: 2026/01/01
logsource:
  product: oracle
  service: ebs
detection:
  selection_web:
    cs-method:
      - 'POST'
      - 'PUT'
      - 'DELETE'
    cs-uri-stem|contains:
      - '/OA_HTML/'
      - '/Calendar'
      - '/calendar'
  selection_user:
    user|contains:
      - 'GUEST'
      - 'ANONYMOUS'
  condition: selection_web
falsepositives:
  - Legitimate low-privilege users performing permitted calendar operations
level: medium
tags:
  - attack.t1190
  - cve.2026.83187

YARA Rule

rule CVE_2026_83187_Oracle_EBS_Calendar_Exploit
{
    meta:
        description = "Detects HTTP-based exploitation attempts against Oracle E-Business Suite Applications Calendar (CVE-2026-83187)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-83187"
        date = "2026-01-01"
        severity = "high"

    strings:
        $ebs1 = "OA_HTML" ascii nocase
        $cal1 = "CommonApplicationsCalendar" ascii nocase
        $cal2 = "ApplicationsCalendar" ascii nocase
        $cal3 = "JTF" ascii nocase
        $http1 = "POST /" ascii
        $http2 = "DELETE /" ascii

    condition:
        (uint16(0) == 0x4854 or true) and
        (($ebs1 and $cal2) or ($cal1) or (($ebs1 and $cal1) and ($http1 or $http2)))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-83187 Oracle E-Business Suite Applications Calendar Unauthorized Data Modification Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"OA_HTML"; nocase; http.uri; content:"Calendar"; nocase; classtype:attempted-admin; reference:cve,2026-83187; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-83187; sid:2026831871; rev:1;)

Elastic Detection

network where
  http.request.method in ("POST", "PUT", "DELETE") and
  (
    url.path like "*/OA_HTML/*Calendar*" or
    url.path like "*/ApplicationsCalendar*" or
    url.path like "*/CommonApplicationsCalendar*"
  ) and
  process.name in ("java", "httpd", "oracle")

Splunk SPL Query

index=web OR index=proxy
(sourcetype=access_combined OR sourcetype=bluecoat OR sourcetype=oracle:ebs)
(method=POST OR method=PUT OR method=DELETE)
uri_path IN ("*OA_HTML*", "*Calendar*", "*ApplicationsCalendar*")
| eval risk="CVE-2026-83187 possible unauthorized Calendar modification"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, uri_path, method, risk
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="oracle_ebs,cve-2026-83187,">
  <rule id="202683187" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <field name="id">\.(POST|PUT|DELETE)</field>
    <match>OA_HTML|Calendar|ApplicationsCalendar</match>
    <description>CVE-2026-83187: Possible Oracle E-Business Suite Applications Calendar unauthorized data modification attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,integrity_abuse,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected version list is available from tracked sources.

1. Immediate Mitigations

• Restrict network access to the EBS application tier. Limit HTTP/HTTPS reachability to trusted networks, VPN, or zero-trust gateways — do not expose EBS directly to the internet.
• Enforce least privilege: audit low-privileged accounts and remove or disable unused/stale accounts, especially GUEST, supplier, or self-registered roles that could be leveraged given the PR:L requirement.
• Apply web application firewall (WAF) rules to monitor and constrain anomalous Applications Calendar data-modification requests (POST/PUT/DELETE) and alert on abnormal volumes or unusual URIs.
• Enable comprehensive audit logging on Applications Calendar data operations and forward logs to the SIEM for integrity-change alerting.
• Monitor Oracle's Critical Patch Update (CPU) and Security Alert channels for an official fix; this CVE has no confirmed patch at time of writing.

2. Patch / Upgrade Steps

• No patch is currently identified in tracked sources. Organizations must monitor Oracle's official advisory portals (Oracle Security Alerts and Critical Patch Updates) for a fix addressing CVE-2026-83187.
• Once a CPU/Security Alert is published, apply it to all EBS 12.2.3–12.2.15 instances following Oracle's standard patching procedures (adop phase, patching of the application tier).
• Verify patch application post-deployment and re-test the Applications Calendar authorization behavior.

3. Long-Term Hardening

• Adopt a defense-in-depth posture for EBS: network segmentation, strict identity and access management, and role-based access control reviews.
• Implement continuous integrity monitoring on critical EBS data sets to detect unauthorized create/modify/delete operations.
• Conduct periodic authorization testing of low-privileged roles to identify broken access control before attackers do.
• Keep EBS within currently supported versions and maintain a documented patch cadence aligned to Oracle CPU releases.

References

• NVD — CVE-2026-83187: https://nvd.nist.gov/vuln/detail/CVE-2026-83187
• Oracle Security Alerts (CPU advisories): https://www.oracle.com/security-alerts/
• Oracle Critical Patch Update program: https://www.oracle.com/security-alerts/cpujul.html (consult latest applicable CPU)
• CISA Known Exploited Vulnerabilities Catalog (CVE not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• EPSS (Exploit Prediction Scoring System) — score 0.00318: https://www.first.org/epss/

Threat actor campaign / exploit-in-the-wild evidence: None identified. CISA KEV status is NO; no public PoC, exploit code, or Nuclei template is available as of this report. Observed exploitation probability remains low (EPSS 24.7th percentile).