SB20261108123 - Multiple vulnerabilities in Oracle Common Applications Calendar

Description

This security bulletin contains information about 3 vulnerabilities.

1) Improper input validation (CVE-ID: CVE-2026-83187)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Applications Calendar component in Oracle Common Applications Calendar in Oracle E-Business Suite. A remote authenticated user can exploit this vulnerability to read and manipulate data.

2) Improper input validation (CVE-ID: CVE-2026-83186)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to modify data and cause limited service disruption.

The vulnerability exists due to improper input validation within the Applications Calendar component in Oracle Common Applications Calendar in Oracle E-Business Suite. A remote authenticated user can exploit this vulnerability to modify data and cause limited service disruption.

3) Improper input validation (CVE-ID: CVE-2026-83179)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to compromise the affected system.

The vulnerability exists due to improper input validation within the Applications Calendar component in Oracle Common Applications Calendar in Oracle E-Business Suite. A remote authenticated user can exploit this vulnerability to compromise the affected system.

Remediation

Install update from vendor's website.

References

• https://www.oracle.com/security-alerts/cspusep2026.html