EUVD-2026-106143
GHSA-rgf2-wh6q-grj9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege EBS account
-
ExploitSend crafted HTTP request to Diagnostics component
-
ExecutionExploit flaw in Oracle Applications Manager
-
ImpactFull takeover of Applications Manager
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privilege Oracle E-Business Suite account with HTTP network access to the Oracle Applications Manager Diagnostics component (CVSS PR:L); it is NOT remotely unauthenticated. Affected deployments are Oracle Applications Manager versions 12.2.3 through 12.2.15. Limiting factors: the authenticated-access prerequisite and reachability of the OAM/Diagnostics HTTP interface, which in well-segmented environments is typically internal-facing rather than internet-exposed; no special non-default configuration is called out in the description. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so any attacker meeting the low-privilege-account condition can exploit it reliably. |
| Impact | This is a genuinely high-priority flaw backed by a strong CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H, base 8.8): network-reachable over HTTP, low attack complexity, no user interaction, and full compromise (takeover) of Oracle Applications Manager within Oracle E-Business Suite. The one meaningful barrier is PR:L - a valid low-privilege account is required, so this is not a fully unauthenticated internet-wide mass-exploitation case but is well within reach of any authenticated user, insider, or attacker holding stolen/low-tier credentials. Key exploitation signals are MISSING: no EPSS score is provided, there is no CISA KEV listing, and no public POC is referenced, so real-world exploitation likelihood cannot be quantified from the input and should not be assumed. Note also a conflict in the metadata: the 'Information Disclosure' tag understates the impact - the description and CVSS (I:H/A:H plus 'takeover') indicate full compromise, not mere disclosure. Oracle EBS Applications Manager is a historically attractive target (prior EBS flaws have reached CISA KEV), so despite the lack of current exploitation evidence this warrants prompt patching in the October 2026 CPU cycle. |
| Exploit ScenarioDerived | An attacker holding a low-privilege Oracle E-Business Suite account (or credentials obtained via phishing/reuse) sends crafted HTTP requests to the Oracle Applications Manager Diagnostics component. Exploiting the flaw with low complexity and no user interaction, the attacker escalates to full takeover of Oracle Applications Manager, gaining control over its confidentiality, integrity, and availability. No public exploit code is identified at time of analysis, so this reflects the attack path implied by the CVSS vector rather than a confirmed in-the-wild technique. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Oracle Applications Manager, the diagnostics and management console bundled with Oracle E-Business Suite 12.2.3 through 12.2.15, can be fully taken over by a low-privileged attacker who has network access to its HTTP interface. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is remote, low-complexity, requires no user interaction, and yields high confidentiality, integrity, and availability impact once a valid low-privilege EBS account is obtained. There is no public exploit code and no CISA KEV confirmation at time of analysis, but the low bar (PR:L, AC:L, UI:N) and the internal-facing nature of many Diagnostics deployments make this a high-priority patching item in the October 2026 Oracle Critical Patch Update.
RemediationAI
Apply the Oracle E-Business Suite fixes in the October 2026 Critical Patch Update - the vendor advisory at https://www.oracle.com/security-alerts/cpuoct2026.html lists the patched OAM releases for the 12.2.x line; upgrade/patch Oracle Applications Manager to the CPU-provided level (later than the affected 12.2.3-12.2.15 range) as directed by Oracle's EBS patching instructions. Because exploitation requires a valid low-privilege EBS account and HTTP reachability to the OAM Diagnostics interface, compensating controls are practical until patching completes: restrict network access to the OAM/Diagnostics HTTP endpoints so only trusted administrator subnets can reach them (side effect: legitimate self-service monitoring by non-admins breaks), and reduce the population of low-privilege accounts able to log into OAM, revoking OAM/Diagnostics responsibilities from users who do not need them (side effect: reduced operational visibility for those users). Monitor EBS application-tier logs for anomalous OAM/Diagnostics requests from low-privilege sessions. No vendor-released patch for this specific CVE beyond the CPU cycle was identified in the supplied data, and no public exploit code or KEV-confirmed exploitation is currently reported, so patching should be prioritized by exposure - internet-facing or broadly internal OAM instances first.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Applications Manager (OAM) is the web-based administration, monitoring, and diagnostics layer shipped with Oracle E-Business Suite, typically reached over HTTP/HTTPS at the EBS application tier. The vulnerable component is Diagnostics, which exposes diagnostic and management functionality through the OAM HTTP interface. The root cause is not publicly detailed (no CWE assigned), but the assessed impact vector (C:H/I:H/A:H) and Oracle's 'takeover of Oracle Applications Manager' language indicate a privilege-escalation / access-control or input-handling weakness in the Diagnostics layer that lets an authenticated low-privilege user break out of their intended authorization boundary and gain administrative control of the OAM application. Because the attack is network-vectored (AV:N) with low complexity (AC:L) and no user interaction (UI:N), the only meaningful prerequisite is a valid low-privilege EBS account (PR:L) plus reachability of the OAM/Diagnostics HTTP endpoint - a common condition in environments where OAM is exposed to broad internal user populations rather than restricted to administrators.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
HTTP-reachable (AV:N) with low complexity and no interaction, but a low-privilege account is required (PR:L); 'takeover' yields full C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle E-Business Suite 12.2.3 through 12.2.15 includes Oracle Applications Manager, and an authenticated low-privileged user with network reach to its HTTP interface could take over the diagnostics console, creating high confidentiality, integrity, and availability risk for ERP operations. Because this internal management surface is often trusted by finance and supply-chain teams, leadership should treat exposure reduction as an operational resilience issue while Oracle's October 2026 Critical Patch Update is pending; no public exploit has been identified at time of analysis.
No vendor-released patch identified at time of analysis; restrict network access to the Oracle Applications Manager HTTP interface, disable the console if not required, enforce least privilege and MFA for EBS accounts, monitor access and administrative activity, and apply the October 2026 Oracle Critical Patch Update when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB