Oracle Contract Lifecycle Management for Public Sector: Improper access control
Summary
Oracle Contract Lifecycle Management for Public Sector, part of Oracle E-Business Suite (component Award/PO), contains an access control flaw (CWE-284). A remote attacker with HTTP access and any low-privileged account can exploit it without user interaction, and successful attacks can lead to takeover of the product, with high impact on confidentiality, integrity and availability. Oracle's CNA rates it CVSS 8.8, while NVD still shows Awaiting Analysis.
Affected
- Oracle Contract Lifecycle Management for Public Sector (Oracle E-Business Suite, component Award/PO): supported versions 12.2.3 to 12.2.15
Fixed in
Unknown. The fixed patch is not confirmed in the sources. Check the Oracle Critical Patch Update Advisory of October 2026 and the Release 12 CPU knowledge document (My Oracle Support Note KA923).
Workaround
- No vendor-documented workaround known.
- Until patched, restrict HTTP access to EBS and Contract Lifecycle Management pages to internal or VPN users (own recommendation, not vendor guidance).
- Review accounts with Award/PO access.
Exploitation
- No evidence of exploitation in the wild or of a public proof of concept found.
- Not listed in the CISA KEV catalog according to the sources found.
- EPSS score about 0.45%.
- Status can change quickly; recheck CISA KEV and vendor updates.
Our recommendation
- If you run Oracle EBS 12.2.3 to 12.2.15 with this module, treat the October 2026 CPU as urgent.
- Confirm the fixed patch in Oracle's advisory and apply it, including the underlying Database and Fusion Middleware components.
- Restrict HTTP access and review accounts with Award/PO access until patched.
- Monitor logs for unusual access to Contract Lifecycle Management pages.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory - October 2026 www.oracle.com
- NVD record via vulners.com (CVE-2026-83363) vulners.com
- CVE list record via vulners.com (CVE-2026-83363) vulners.com
- Oracle EBS Java CPU checker update (Oracle blog) blogs.oracle.com
- Oracle October 2026 CPU overview (Brandefense, secondary) brandefense.io
- Strix.ai CVE entry (secondary aggregator) www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:44.
Original description (NVD)
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector. Successful attacks of this vulnerability can result in takeover of Oracle Contract Lifecycle Management for Public Sector. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.