Oracle Applications Manager CVE-2026-60322

No special conditions - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated remote exploitation against default configurations of Oracle Applications Manager 12.2.3-12.2.15. The attacker requires only HTTP network connectivity to the Oracle E-Business Suite instance; no account credentials, authenticated session, or victim interaction are needed. The specific exploitation surface is the Oracle Diagnostics Interfaces component within OAM. Exploitation is limited to versions 12.2.3 through 12.2.15 - versions outside this range are not listed as affected. Impact is constrained to C:L/I:L/A:N: the attacker can read a subset of OAM-accessible data and manipulate some OAM records, but cannot achieve remote code execution, cause a denial of service, or pivot to other systems (S:U - scope unchanged). Deployments where OAM is not network-reachable or where the Diagnostics Interfaces are blocked at a web/network layer are not exploitable via this vulnerability.

The CVSS 3.1 score of 6.5 (Medium) reflects a network-exploitable, unauthenticated vulnerability with partial confidentiality and integrity impact and no availability impact (C:L/I:L/A:N, S:U). The vector AV:N/AC:L/PR:N/UI:N/S:U confirms exploitation is straightforward and requires no attacker privileges or victim interaction. No EPSS score was provided, so exploitation probability cannot be quantified from that source. The vulnerability is not listed in CISA KEV, and no public PoC has been identified, which moderates urgency relative to the CVSS vector. The 'Authentication Bypass' tag is a meaningful signal - authentication bypass flaws in diagnostic or administrative interfaces of enterprise ERP systems have historically attracted targeted exploitation by financially motivated threat actors. Oracle EBS deployments are high-value targets. The scope being unchanged (S:U) limits the blast radius to OAM-accessible data only and rules out lateral pivot to other systems directly via this flaw. Real-world risk is moderate but non-trivial: the ease of exploitation (AC:L, PR:N) combined with the enterprise sensitivity of OAM data makes this a genuine remediation priority, particularly for any EBS instance with internet-facing or weakly segmented HTTP exposure. The lack of KEV listing and availability of an Oracle CPU patch reduce urgency below critical but this should not be deferred in environments where EBS is externally reachable.

An unauthenticated attacker who can reach the Oracle EBS HTTP interface - either from the internet if the instance is externally exposed, or from an internal network segment - sends crafted HTTP requests directly to the Oracle Diagnostics Interfaces endpoint, bypassing authentication. The attacker enumerates and reads a subset of OAM configuration or application data, and issues manipulative requests to insert, update, or delete records within the OAM data scope, potentially altering diagnostic configurations, application settings, or operational data visible to administrators.