EUVD-2026-46737
GHSA-84rj-pcmg-3qrm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-reachable unauthenticated endpoint confirmed by description and PR:N vector; C:L and I:L match stated partial read and write impact with no availability effect.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Manager accessible data as well as unauthorized read access to a subset of Oracle Applications Manager accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
AnalysisAI
Unauthenticated remote data exposure and manipulation affects Oracle Applications Manager versions 12.2.3 through 12.2.15 within Oracle E-Business Suite, via the Oracle Diagnostics Interfaces component. An attacker with HTTP network access can bypass authentication to read a subset of OAM-accessible data and perform unauthorized insert, update, or delete operations against OAM data - no credentials or user interaction required. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, the low attack complexity and unauthenticated vector raise real-world concern for internet-facing or poorly segmented EBS deployments.
Technical ContextAI
Oracle Applications Manager (OAM) is a web-based administrative console embedded in Oracle E-Business Suite (EBS), used to configure, monitor, and diagnose Oracle applications workloads. The vulnerable component - Oracle Diagnostics Interfaces - appears to expose diagnostic or instrumentation endpoints that lack proper authentication enforcement, consistent with the 'Authentication Bypass' tag assigned to this CVE. No CWE was assigned by Oracle or NVD, but the combination of PR:N in the CVSS vector and the Authentication Bypass classification points toward CWE-306 (Missing Authentication for Critical Function) or CWE-284 (Improper Access Control) as the most plausible root cause classes. The CPE (cpe:2.3:a:oracle_corporation:oracle_applications_manager:*:*:*:*:*:*:*:*) covers the Oracle Corporation OAM application broadly across the affected version range 12.2.3-12.2.15. The vulnerability operates over HTTP (AV:N), requires no special conditions (AC:L), and affects the application tier of Oracle EBS, not the underlying Oracle Database layer directly.
RemediationAI
Apply the Oracle Critical Patch Update (CPU) for July 2026, available via https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability across Oracle E-Business Suite versions 12.2.3 through 12.2.15. An exact patched sub-version number was not independently confirmed beyond the Oracle CPU reference - consult the Oracle My Oracle Support (MOS) note associated with the July 2026 CPU for the precise patch number and application instructions. As an interim compensating control, restrict network access to the Oracle Diagnostics Interfaces endpoints at the web tier or network perimeter - specifically block external HTTP access to diagnostic URL paths (e.g., /OA_HTML/OADiag* or equivalent) using a WAF or network firewall rule; note this may impact internal monitoring tools that rely on these endpoints. Ensure Oracle EBS is not directly internet-facing without a reverse proxy or WAF layer. Do not delay patching: the low attack complexity and unauthenticated vector mean network-reachable instances are straightforward targets once a PoC becomes available.
More in Oracle Applications Manager
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today