{"cve":"CVE-2026-83456","enrichment":{"affected":[{"configurations":[{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[12.2.3,12.2.15]"}}],"enrichment":{"confidence":95.0,"confidence_source":"inferred","scores":[{"score":95.0,"source":"inferred"},{"score":100.0,"source":"matching"}]},"original":{"product":"Oracle Demand Signal Repository","source":"cna","vendor":"Oracle Corporation"},"product":"demand_signal_repository","vendor":"oracle"}],"created":"2026-09-16T12:30:07.780173+00:00","title":"Low‑Privileged HTTP Exploit Enables Takeover of Oracle Demand Signal Repository","updated":"2026-09-20T07:30:17.513164+00:00","vendors":["oracle","oracle$PRODUCT$demand_signal_repository"]},"epss":{"score":0.00417},"mitre":{"cpes":["cpe:2.3:a:oracle:demand_signal_repository:*:*:*:*:*:*:*:*"],"created":"2026-09-15T20:05:41.572000+00:00","description":"Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Demand Signal Repository.  Successful attacks of this vulnerability can result in takeover of Oracle Demand Signal Repository. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/83xxx/CVE-2026-83456.json","references":["https://www.oracle.com/security-alerts/cspusep2026.html"],"title":null,"updated":"2026-09-17T13:00:23.374000+00:00","vendors":["oracle","oracle$PRODUCT$demand_signal_repository"],"weaknesses":[]},"nvd":{"cpes":[],"created":"2026-09-15T20:18:54.387000+00:00","description":"Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Demand Signal Repository.  Successful attacks of this vulnerability can result in takeover of Oracle Demand Signal Repository. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-83456.json","references":["https://www.oracle.com/security-alerts/cspusep2026.html"],"title":null,"updated":"2026-09-17T14:17:44.630000+00:00","vendors":[],"weaknesses":["CWE-269"]},"opencve":{"changes":[{"created":"2026-09-15T20:15:00+00:00","data":[{"details":{"new":"Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Demand Signal Repository.  Successful attacks of this vulnerability can result in takeover of Oracle Demand Signal Repository. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","old":null},"type":"description"},{"details":["oracle","oracle$PRODUCT$demand_signal_repository"],"type":"first_time"},{"details":{"added":["cpe:2.3:a:oracle:demand_signal_repository:*:*:*:*:*:*:*:*"],"removed":[]},"type":"cpes"},{"details":{"added":["oracle","oracle$PRODUCT$demand_signal_repository"],"removed":[]},"type":"vendors"},{"details":{"added":["https://www.oracle.com/security-alerts/cspusep2026.html"],"removed":[]},"type":"references"},{"details":{"added":{"cvssV3_1":{"score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"ca10e20f-290e-4628-bc38-08a8f0860c37"},{"created":"2026-09-16T23:45:00+00:00","data":[{"details":{"new":"Remote Code Execution Vulnerability in Oracle Demand Signal Repository via HTTP","old":null},"type":"title"},{"details":{"added":["CWE-284","CWE-862"],"removed":[]},"type":"weaknesses"}],"id":"03057f67-e984-4ea6-98ea-596c5b5aeb26"},{"created":"2026-09-17T14:30:00+00:00","data":[{"details":{"added":["CWE-269"],"removed":[]},"type":"weaknesses"},{"details":{"added":{"ssvc":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"total"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"d3970c97-0374-47c0-9ffb-8f57f82e8c1a"},{"created":"2026-09-18T15:00:00+00:00","data":[{"details":{"new":null,"old":"Remote Code Execution Vulnerability in Oracle Demand Signal Repository via HTTP"},"type":"title"},{"details":{"added":[],"removed":["CWE-284","CWE-862"]},"type":"weaknesses"}],"id":"e7c4aacf-d531-4683-9a75-b7b25faacc18"},{"created":"2026-09-20T07:45:00+00:00","data":[{"details":{"new":"Low‑Privileged HTTP Exploit Enables Takeover of Oracle Demand Signal Repository","old":null},"type":"title"}],"id":"a7d94feb-3d9c-40f2-80b1-54b1612642b0"}],"cpes":{"data":["cpe:2.3:a:oracle:demand_signal_repository:*:*:*:*:*:*:*:*"],"providers":["mitre"]},"created":{"data":"2026-09-15T20:05:41.572000+00:00","provider":"mitre"},"description":{"data":"Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Demand Signal Repository.  Successful attacks of this vulnerability can result in takeover of Oracle Demand Signal Repository. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"provider":"mitre"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.00417},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"total"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://www.oracle.com/security-alerts/cspusep2026.html"],"providers":["mitre","nvd"]},"title":{"data":"Low‑Privileged HTTP Exploit Enables Takeover of Oracle Demand Signal Repository","provider":"enrichment"},"updated":{"data":"2026-09-20T07:30:17.513164+00:00","provider":"enrichment"},"vendors":{"data":["oracle","oracle$PRODUCT$demand_signal_repository"],"providers":["mitre","enrichment"]},"weaknesses":{"data":["CWE-269"],"providers":["nvd","vulnrichment"]}},"vulnrichment":{"cpes":[],"created":"2026-09-15T20:05:41.572000+00:00","description":"Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Demand Signal Repository.  Successful attacks of this vulnerability can result in takeover of Oracle Demand Signal Repository. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{},"kev":{},"ssvc":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"total"},"version":"2.0.3"}},"references":[],"title":null,"updated":"2026-09-17T12:58:25.975000+00:00","vendors":[],"vulnrichment_repo_path":"2026/83xxx/CVE-2026-83456.json","weaknesses":["CWE-269"]}}