EUVD-2026-106049
GHSA-26c4-m3v7-r9m4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged EBS account
-
ExploitSend crafted HTTPS request to Report Manager
-
ExecutionExploit Internal Operations flaw
-
ImpactRead all accessible data / partial write / partial DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated low-privileged account on Oracle Report Manager within Oracle E-Business Suite (per CVSS PR:L and the 'low privileged attacker' description), reaching the Internal Operations component over the network via HTTPS. It affects EBS Report Manager versions 12.2.3 through 12.2.15. No user interaction is required and attack complexity is low, but the need for valid credentials - rather than unauthenticated access - is the primary factor limiting real-world exploitation; internet-facing EBS instances with easily obtained low-tier accounts are most at risk. |
| Impact | This is a credible mid-tier priority rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable (HTTPS), low-complexity attack requiring only low privileges and no user interaction, which is genuinely attractive to attackers who already hold any authenticated Oracle Report Manager/EBS account. The 7.6 score is driven by high confidentiality impact (C:H - full read of all Report Manager-accessible data) combined with partial integrity (I:L) and partial availability (A:L). No EPSS score was provided, the CVE is NOT on the CISA KEV list, and no public POC is referenced - so there is no evidence of active exploitation, only theoretical reachability. Note a conflict in the input metadata: the 'Authentication Bypass' tag contradicts the CVSS vector, which explicitly requires PR:L (an authenticated low-privileged account), so this is a privilege-based data exposure, not an unauthenticated auth bypass - verify against the Oracle CPU advisory. The practical limiting factor is the need for valid low-privileged credentials, which lowers real-world risk below what the raw 7.6 suggests for internet-exposed but unauthenticated attackers. |
| Exploit ScenarioDerived | An attacker possessing any low-privileged Oracle Report Manager or E-Business Suite account sends crafted authenticated HTTPS requests to the Internal Operations component. Because attack complexity is low and no user interaction is needed, they read all Report Manager-accessible data and make limited unauthorized modifications or trigger a partial denial of service. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Authenticated low-privileged users can compromise Oracle Report Manager in Oracle E-Business Suite versions 12.2.3 through 12.2.15 over HTTPS, gaining high confidentiality impact plus limited integrity and availability impact (CVSS 7.6). The flaw is in the Internal Operations component and requires only a valid low-tier account, low attack complexity, and no user interaction; no public exploit code was identified at time of analysis.
RemediationAI
Apply the Oracle Critical Patch Update October 2026 fix for Oracle E-Business Suite Report Manager; the provided data does not specify an exact patch version, so use the vendor advisory at https://www.oracle.com/security-alerts/cpuoct2026.html to identify the applicable 12.2.x patch. Until patched, restrict HTTPS access to Report Manager and the Internal Operations component to trusted networks or jump hosts, enforce strong authentication and least privilege to limit the availability of low-privileged accounts, and monitor for anomalous report or data access. These controls reduce exposure but do not remove the underlying flaw, and network restriction may disrupt legitimate remote reporting users.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle E-Business Suite is a large ERP platform, and Report Manager provides reporting and report administration functions. This issue resides in the Internal Operations component and is reachable over HTTPS. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L indicates network access, low privileges, no user interaction, unchanged scope, high confidentiality impact, and low integrity/availability impact. No CWE was assigned in the provided data and Oracle has not published root-cause details; the source tags classify it as an authentication-bypass and denial-of-service issue, which is consistent with an access-control weakness in Internal Operations that may expose critical data and permit limited modification or disruption. No CPE strings were included in the input.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Network HTTPS reach with low complexity and no UI; PR:L because a low-privileged account is required; C:H with partial I/A matching the described partial update and partial DoS.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Report Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Report Manager accessible data as well as unauthorized update, insert or delete access to some of Oracle Report Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Report Manager. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).
Executive ViewAI
Oracle E-Business Suite Report Manager versions 12.2.3 through 12.2.15 contain a high-severity Internal Operations flaw that can expose sensitive report data to users with low-level accounts. Leadership should care because EBS commonly supports finance, HR, and operational reporting, so a confidentiality exposure could affect regulated data and business trust. No public exploit was identified at time of analysis, but no vendor patch is available, making access restriction and monitoring the immediate priorities.
No vendor-released patch identified at time of analysis; restrict Report Manager/Internal Operations access to trusted networks or VPN, disable the component if not required, enforce least privilege and remove unnecessary low-tier accounts, monitor and alert on anomalous report access or export, and apply Oracle interim guidance or virtual patching where feasible until a patch is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB