EUVD-2026-106050
GHSA-4rxr-4xj4-rmhm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged EBS account
-
ExploitAuthenticate to Report Manager over HTTPS
-
ExecutionSend crafted request to Internal Operations component
-
ImpactRead unauthorized confidential data or induce partial DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated, low-privileged account on Oracle Report Manager within Oracle E-Business Suite versions 12.2.3 through 12.2.15, with network reachability to the application over HTTPS (the Internal Operations component). No user interaction is needed and attack complexity is low once authenticated. The principal limiting factor is the credential requirement (PR:L): the attacker must already possess valid Report Manager/EBS login access, making this most relevant to malicious insiders or attackers who have otherwise harvested credentials rather than anonymous internet attackers. |
| Impact | This is a genuine mid-tier priority rather than a theoretical high-CVSS issue, but it is not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, score 7.1) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with high confidentiality impact and partial availability impact. The practical gating factor is PR:L - the attacker must already hold a valid low-privileged Report Manager / E-Business Suite account, which meaningfully narrows the exploit population to insiders or attackers who have already obtained credentials, unlike a pre-auth flaw. No EPSS score was supplied in the input, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no public POC is referenced, so there is no evidence of active exploitation - only the vendor CPU advisory. Note a signal conflict: the input Tags include 'Authentication Bypass', but the CVSS vector explicitly requires privileges (PR:L), which contradicts a true authentication-bypass characterization - verify the tag against the Oracle advisory rather than treating this as a pre-auth bypass. |
| Exploit ScenarioDerived | An attacker holding a low-privileged Oracle Report Manager account (or stolen credentials for one) sends crafted HTTPS requests to the application to read confidential report data outside their authorization boundary, potentially exposing all Report Manager-accessible data. The same access can be abused to trigger a partial denial of service of the Report Manager service. No public exploit code is referenced, so exploitation would require independent development against the authenticated interface. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Authenticated, low-privileged users of Oracle Report Manager in Oracle E-Business Suite 12.2.3 through 12.2.15 can read all data reachable by the component and partially degrade its availability by sending HTTPS requests against the Internal Operations component. Oracle rates this 7.1 (C:H/I:N/A:L) with low attack complexity and no user interaction, so the practical barrier is the requirement for a valid EBS/Report Manager login rather than any technical complexity. No public exploit code or CISA KEV entry was identified at time of analysis, and the supplied data contains no EPSS score.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html); patch availability is confirmed by the vendor advisory but the supplied data does not state a specific patched build number, so confirm the target RU/CPU level against that advisory before closing the finding. Until patching is complete, restrict network reachability to Report Manager HTTPS endpoints to trusted networks or VPN segments, accepting the trade-off that remote and partner users lose direct access; review and reduce the population of accounts holding Report Manager responsibilities, recognizing that this may slow legitimate reporting workflows; and add monitoring or alerting on abnormal bulk report retrieval and on availability failures in the Internal Operations component, understanding that this is detective rather than preventive and will not stop data exposure from an already-compromised low-privileged account. Because exploitation requires valid credentials, prioritizing credential hygiene, MFA where supported, and session review for Report Manager users materially reduces exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue sits in Oracle E-Business Suite's Report Manager product, specifically the Internal Operations component, which brokers report generation and report-data access inside the EBS application tier. Oracle's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) describes a scope-unchanged weakness that requires a valid low-privileged account but no user interaction and no special conditions, yielding high confidentiality impact and low availability impact with no integrity impact. That profile is consistent with an access-control or authorization-scope defect that lets an ordinary Report Manager user reach report data and internal operations beyond their intended privilege level, plus a path to partially disrupt component availability. No CWE identifier was assigned in the supplied data, and the feed tags 'Authentication Bypass' and 'Denial Of Service' should be read alongside PR:L: any bypass is best understood as an authorization or access-scope weakness exploited after login, not an unauthenticated internet entry point, because the assessed vector still requires credentials. No CPE strings were provided; the authoritative affected-range statement comes from EUVD ('Oracle Report Manager 12.2.3 <= 12.2.15') and Oracle's own advisory.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
HTTPS network vector (AV:N), low complexity, and an explicit low-privileged account requirement (PR:L); high confidentiality, no integrity, and partial availability (A:L) per the description.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Report Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Report Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Report Manager. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).
Executive ViewAI
Oracle E-Business Suite Report Manager 12.2.3 through 12.2.15 creates a data-exposure and reporting-availability risk for business users with valid low-privilege Report Manager credentials, and no vendor-released patch is identified at time of analysis. Leadership should care because an internal reporting account could access sensitive data reachable by the component and disrupt reporting availability, while no public exploit identified at time of analysis reduces but does not remove urgency.
No vendor-released patch identified at time of analysis. Restrict network access to Oracle Report Manager and Internal Operations endpoints, enforce least-privilege Report Manager roles, monitor HTTPS requests and data access for anomalies, enable strong authentication and session controls, and use WAF/IPS virtual patching where feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB