EUVD-2026-106183
GHSA-5xrv-g437-c3r5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged EBS account
-
ExploitSend crafted HTTP request to Diagnostics Interfaces
-
ExecutionBypass authorization check
-
ImpactRead all accessible confidential data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid low-privileged account on Oracle Applications Manager (CVSS PR:L) with network HTTP access to the Oracle Diagnostics Interfaces component; affected supported versions are Oracle E-Business Suite 12.2.3 through 12.2.15. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so any authenticated low-privilege user can exploit it against default-reachable Applications Manager endpoints. The authentication requirement is the primary limiting factor - purely unauthenticated attackers cannot exploit this - and impact is confined to disclosure of confidential data (no integrity or availability effect). |
| Impact | The CVSS 3.1 base score is 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, meaning network-reachable over HTTP, low attack complexity, but requiring at least low-level authentication (PR:L) and yielding only confidentiality impact (C:H, I:N, A:N). No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no proof-of-concept is referenced, so there is no public exploit identified at time of analysis. No SSVC decision data was supplied. Note a conflict in the input: the 'Authentication Bypass' tag contradicts the CVSS PR:L metric, which explicitly requires a valid low-privileged account - this is a credentialed information-disclosure issue, not an unauthenticated bypass; verify the correct classification with Oracle. Overall this is a moderate-priority patch item rather than an emergency: the confidentiality-only impact and the authenticated prerequisite temper the network-facing exposure, but Oracle E-Business Suite's sensitivity and broad enterprise use warrant inclusion in the next scheduled Oracle CPU patch cycle. |
| Exploit ScenarioDerived | An attacker possessing a low-privileged Oracle Applications Manager account sends crafted HTTP requests to the Oracle Diagnostics Interfaces component to read data they should not be authorized to access. Because attack complexity is low and no user interaction is needed, a single authenticated user can retrieve critical data across all Oracle Applications Manager-accessible data. No public proof-of-concept is referenced in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Oracle Applications Manager in Oracle E-Business Suite 12.2.3 through 12.2.15 allows any authenticated low-privileged user with HTTP network access to read critical data through the Oracle Diagnostics Interfaces component. Exploitation is low-complexity and requires no user interaction, but the need for a valid account limits exposure; impact is confidentiality-only (CVSS 6.5, C:H/I:N/A:N). No public exploit code or confirmed active exploitation was identified at time of analysis.
RemediationAI
Apply the October 2026 Oracle Critical Patch Update (CPU) for Oracle E-Business Suite, which addresses CVE-2026-101782 per the vendor advisory at https://www.oracle.com/security-alerts/cpuoct2026.html; the input data does not provide a specific patched build number beyond the CPU. As compensating controls until patching, restrict HTTP access to Oracle Applications Manager and Oracle Diagnostics Interfaces endpoints to trusted networks or jump hosts (side effect: reduced remote administration convenience), audit and minimize low-privileged accounts that can reach Applications Manager (side effect: operational overhead and potential disruption to legitimate diagnostic users), and if Diagnostics Interfaces is not required, disable or block it at the web tier (side effect: loss of diagnostic and troubleshooting functionality). Monitor application logs for anomalous data access by low-privileged users.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle E-Business Suite is Oracle's ERP application suite; Oracle Applications Manager provides management, monitoring, and diagnostics for EBS environments, and the Oracle Diagnostics Interfaces component exposes HTTP-accessible diagnostic endpoints. The assessed CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) describes a network-reachable, low-complexity access-control/data-exposure weakness: a user with a valid low-privileged account can reach functionality that returns data beyond their intended authorization scope. The reporter's 'Authentication Bypass' tag should not be interpreted as pre-authentication exploitation - PR:L is required per the authoritative assessment. No CWE is provided, so the precise root-cause class (e.g., missing authorization check, insecure direct object reference, or information exposure) is not confirmed from available data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network HTTP vector with low complexity and no user interaction, but a low-privileged account is required (PR:L); impact is confidentiality-only, so I:N and A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB