# Oracle E-Business Suite 159 vulnerabilities patched

Published: 2026-09-16 · Severity: elevated · Sectors: financial-services, government-national, manufacturing, retail
Canonical: https://vorant.io/reports/c4a96de0-f721-5c56-bdbc-cc93523c1080/oracle-e-business-suite-159-vulnerabilities-patched

> Oracle patches 159 E-Business Suite flaws including three critical remote code execution issues requiring no authentication.

Oracle has released security updates addressing 159 vulnerabilities across multiple E-Business Suite products and modules. Three vulnerabilities have been designated critical with CVSS scores of 9.8: CVE-2026-83327 in Oracle Applications Framework, CVE-2026-83452 in Oracle Document Management and Collaboration, and CVE-2026-83462 in Oracle Mobile Application Server. These critical flaws can be exploited remotely without authentication, require low attack complexity, and involve no user interaction. Successful exploitation grants complete control of affected components with high impact to confidentiality, integrity, and availability.

Of the total 159 vulnerabilities, 19 can be exploited remotely without authentication. The remaining issues may require user interaction, low privilege levels, or prior access. Vulnerability impacts range from unauthorized access to sensitive information, data modification or deletion, full system compromise, and denial of service. CVSS scores span from 5.4 to 9.8. The affected products include Oracle Applications Framework, Oracle Document Management and Collaboration, Oracle Mobile Application Server, Oracle Alert, Oracle Contracts, Oracle HRMS, Oracle Financials modules, Oracle CRM components, Oracle Sales, and numerous other E-Business Suite applications. The NCSC-NL advises prioritizing patching of the three critical vulnerabilities and deploying available updates across all affected components.

## Mentioned in this report

- Vulnerabilities: CVE-2026-83072, CVE-2026-83083, CVE-2026-83089, CVE-2026-83090, CVE-2026-83110, CVE-2026-83119, CVE-2026-83120, CVE-2026-83121, CVE-2026-83122, CVE-2026-83124, CVE-2026-83125, CVE-2026-83135, CVE-2026-83136, CVE-2026-83137, CVE-2026-83163, CVE-2026-83164, CVE-2026-83165, CVE-2026-83168, CVE-2026-83172, CVE-2026-83189, CVE-2026-83194, CVE-2026-83205, CVE-2026-83327, CVE-2026-83329, CVE-2026-83331, CVE-2026-83338, CVE-2026-83425, CVE-2026-83449, CVE-2026-83451, CVE-2026-83452, CVE-2026-83454, CVE-2026-83456, CVE-2026-83462, CVE-2026-83479, CVE-2026-87125, CVE-2026-87150, CVE-2026-87155, CVE-2026-87162, CVE-2026-87163, CVE-2026-87165

## Detection guidance (public sample)

### Oracle E-Business Suite Application Tier Java Process Spawning Shell or Download Tool

ATT&CK: T1190

Detects the Java managed server of an Oracle EBS WebLogic application tier (oacore, oafm, forms) spawning a shell or download utility, a typical post-exploitation pattern after unauthenticated remote exploitation of the web tier. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Oracle E-Business Suite Application Tier Java Process Spawning Shell or Download
  Tool
id: 5d42b889-5c14-599f-8bb2-187b02d36d9c
status: experimental
description: Detects the Java managed server of an Oracle E-Business Suite WebLogic
  application tier (oacore, oafm, forms) spawning an interactive shell or download/network
  utility. This is a common post-exploitation pattern after remote unauthenticated
  exploitation of a public-facing EBS component (for example Applications Framework,
  Document Management and Collaboration, or Mobile Application Server). Matches the
  parent/child relation, not any specific CVE payload.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: /java
    ParentCommandLine|contains:
    - oacore_server
    - oafm_server
    - forms_server
    - Dweblogic.Name=oacore
    - Dweblogic.Name=oafm
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /curl
    - /wget
    - /nc
    - /ncat
    - /python
    - /python3
    - /perl
  condition: selection_parent and selection_child
falsepositives:
- Oracle EBS patching or AutoConfig scripts launched from the managed server JVM
- Custom concurrent program or integration wrappers that legitimately shell out from
  the application tier
level: medium
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0376.html
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0376.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/c4a96de0-f721-5c56-bdbc-cc93523c1080/oracle-e-business-suite-159-vulnerabilities-patched.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup