Oracle Applications Manager CVE-2026-101805

Exploitation targets the Diagnostics component of Oracle Applications Manager within Oracle E-Business Suite, versions 12.2.3 through 12.2.15, over HTTP. The decisive limiting factors are explicit in the CVSS vector: the attacker must already hold HIGH privileges on Applications Manager (PR:H - a trusted/administrative account), and attack complexity is HIGH (AC:H), meaning success depends on conditions outside the attacker's direct control rather than a single reliable request. No user interaction is required (UI:N) and scope is unchanged (S:U). This is not remote-unauthenticated exploitation; the realistic risk is confined to environments where an adversary can obtain or abuse a high-privilege EBS account, which sharply narrows the exposed population.

This is a low-severity issue (CVSS 3.1 base 3.3) whose own vector is the strongest argument against urgent prioritization. The vector AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L requires an attacker who ALREADY holds high privileges (PR:H) on Oracle Applications Manager and faces high attack complexity (AC:H), while the payoff is limited: only partial confidentiality disclosure (C:L) and a partial denial of service (A:L), with no integrity impact (I:N). No EPSS score was provided in the input, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced - so there is no public exploit identified at time of analysis. The signals are internally consistent rather than conflicting: a difficult-to-exploit, high-privilege-gated flaw with low impact is a genuine low-priority patch-in-normal-cycle item, not a high-CVSS-but-low-real-risk mislabel and not an under-scored sleeper. The main caveat is that a high-privileged EBS user who can reach Diagnostics is often a trusted administrator, so the realistic threat is privilege misuse or an already-compromised admin account rather than external mass exploitation. EPSS is absent (not retrievable from this input) and should be checked before final triage.

An attacker who has already obtained high-privilege access to an Oracle Applications Manager instance (for example a compromised administrator account or a malicious insider) sends crafted HTTP requests to the Diagnostics component. Because attack complexity is high, exploitation requires specific conditions or timing, but success yields read access to a subset of Applications Manager data and the ability to partially disrupt its availability. No public exploit code is known, so this would require original development by a capable, already-privileged actor.