What is the CVSS score of CVE-2026-83157?

CVE-2026-83157 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H.

Which versions of Oracle are affected by CVE-2026-83157?

Oracle E-Business Suite deployments running Applications Manager (versions 12.2.3 through 12.2.15) are exposed to a high-severity flaw that allows an already-privileged operator to seize full control…

How to fix or mitigate CVE-2026-83157?

Within 24 hours, confirm which of your EBS environments run Applications Manager 12.2.3 through 12.2.15, restrict network access to the Applications Manager HTTP interfaces so only trusted administrative subnets can reach them, and audit accounts holding RapidClone command-line privileges to ensure they are limited to the smallest possible set of administrators. Within 7 days, apply network segmentation to isolate EBS application tiers from general corporate networks, enable detailed logging and alerting on Applications Manager command-line activity and administrative sessions, and review privilege assignments for unnecessary elevated roles. Within 30 days, establish a recurring review of Oracle's Critical Patch Update and security advisory channels so the vendor patch is deployed immediately upon release, validate that compensating controls remain enforced through configuration baselines, and rehearse incident response for full host takeover of an EBS application tier. Vendor-released patch: none identified at time of analysis.

Oracle CVE-2026-83157

EUVD-2026-79484 HIGH

2026-09-15 secalert_us@oracle.com

GHSA-4jgj-jmqp-633q

Information Disclosure Oracle

8.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.0 HIGH

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 21:37 vuln.today

CVE Published

Sep 15, 2026 - 20:18 nvd

HIGH 8.0

DescriptionNVD

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications Manager. While the vulnerability is in Oracle Applications Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Command-line processing in Oracle Applications Manager, a component of Oracle E-Business Suite 12.2.3 through 12.2.15, can be abused by a high-privileged attacker with network access over HTTP to take full control of the Applications Manager host and, because of a scope change, to significantly impact other linked EBS products. Oracle's own vector (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) indicates that exploitation is difficult and requires an already-elevated account (a privileged operator, administrator, or equivalent account with access to the RapidClone command-line functionality), and no public exploit code or CISA KEV listing has been identified at time of analysis. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, confirm which of your EBS environments run Applications Manager 12.2.3 through 12.2.15, restrict network access to the Applications Manager HTTP interfaces so only trusted administrative subnets can reach them, and audit accounts holding RapidClone command-line privileges to ensure they are limited to the smallest possible set of administrators. …

Threat intelligence, references, and detailed analysis are available after sign-in.