What is the CVSS score of CVE-2026-83338?

CVE-2026-83338 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2026-83338?

Within 24 hours, restrict network access to Oracle E-Business Suite 12.2.3 through 12.2.15 instances, particularly Oracle Applications Manager and Diagnostics Interfaces, by limiting HTTP access to trusted IP ranges and ensuring all access requires authentication; audit and disable unnecessary low-privileged accounts. Within 7 days, implement compensating controls such as web application firewall rules to block anomalous requests to Diagnostics Interfaces, enable detailed logging and monitoring for privilege escalation or data exfiltration, and review Oracle's advisory for any interim mitigations. Within 30 days, plan emergency change windows to apply the Oracle September 2026 Critical Patch Update as soon as it is released, and conduct a thorough review of user access privileges to minimize the number of low-privileged accounts that can reach the vulnerable component.

Oracle Applications Manager CVE-2026-83338

EUVD-2026-79691 HIGH

Improper Privilege Management (CWE-269)

2026-09-15 secalert_us@oracle.com

GHSA-2gqw-8f72-j5mx

Privilege Escalation Oracle

8.8

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain low-privileged EBS account
Delivery

Reach Oracle Applications Manager over HTTP
Exploit

Exploit Diagnostics Interfaces flaw
Execution

Escalate to component takeover
Impact

Read/modify data and disrupt service

Vulnerability Assessment

Weakness	CWE CWE-269 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V8 - Authorization Least privilege enforcement MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires a low-privileged authenticated account on Oracle E-Business Suite (PR:L) with network HTTP access to the Oracle Applications Manager component (Oracle Diagnostics Interfaces). Affected releases are Oracle E-Business Suite 12.2.3 through 12.2.15; deployments outside this range or already patched via the September 2026 CPU are not exploitable. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The main limiting factor is the authentication requirement - this is not pre-auth - so exposure is largest where many low-trust users can authenticate or where the EBS instance is broadly/internet-accessible.
Impact	The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, yielding full confidentiality, integrity and availability compromise ('takeover of Oracle Applications Manager'). That is a genuinely high-impact profile. However, exploitation signals are cool: EPSS is only 0.45% (38th percentile), there is no CISA KEV listing and no public exploit code identified, so this is not currently evidence of widespread exploitation. No SSVC decision data was provided. The gating factor is PR:L - the attacker must already hold a valid, if low-privileged, EBS/Applications Manager account, which meaningfully narrows the population of realistic attackers versus a pre-auth flaw. Net: a real patch-priority item for internet-exposed or broadly-accessible Oracle E-Business Suite deployments given the impact and Oracle EBS's history of being targeted, but the current probabilistic signals (low EPSS, no KEV, no POC) argue for prompt scheduled patching rather than emergency response. Note the input tag 'Information Disclosure' conflicts with the vector, which shows I:H/A:H (full compromise, not confidentiality-only).
Exploit ScenarioDerived	An attacker who has obtained any low-privileged Oracle E-Business Suite account (e.g., a self-service or limited application user) sends crafted HTTP requests to the Oracle Applications Manager / Oracle Diagnostics Interfaces component. By abusing the vulnerable interface they escalate to full control of Oracle Applications Manager, reading and altering data and disrupting the service. No public proof-of-concept exploit has been identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 17, 2026

Authenticated, low-privileged network attackers can achieve full takeover of Oracle Applications Manager in Oracle E-Business Suite 12.2.3 through 12.2.15 through the Oracle Diagnostics Interfaces component, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is network-reachable over HTTP, requires only a low-privileged account and no user interaction, and is not pre-authentication, so exposure is greatest where many low-trust users can authenticate or where the EBS instance is internet-accessible. No public exploit code has been identified at time of analysis and EPSS is 0.45% (38th percentile); Oracle addresses the flaw in its September 2026 Critical Patch Update.

RemediationAI

Patch status: Patch available per vendor advisory. Oracle released the fix through its September 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspusep2026.html); no exact patched build number is provided in the available data, so apply that CPU to Oracle E-Business Suite 12.2.3-12.2.15 as the primary remediation. Because the flaw requires only low privileges and network HTTP access (PR:L, AV:N), reduce exposure by restricting network reachability of Oracle Applications Manager and the Oracle Diagnostics Interfaces endpoint to trusted administrative networks such as a VPN or management VLAN - the trade-off is reduced accessibility for legitimate diagnostics users. If Oracle Diagnostics Interfaces is not operationally required, disabling or blocking access to it removes the attack surface, with the side effect of losing diagnostic functionality; otherwise monitor HTTP access logs for anomalous requests from low-privileged sessions and consider rate-limiting or WAF inspection in front of the console. Audit and remove unnecessary low-privilege EBS accounts, since any authenticated user meeting the PR:L requirement can reach the vulnerable interface.

Affected VersionsENISA

Oracle Applications Manager 12.2.3 ≤12.2.15

Affected Packages

euvd oracle_applications_manager no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Oracle Applications Manager is an administrative web console for Oracle E-Business Suite, and the affected component is Oracle Diagnostics Interfaces, an HTTP-reachable interface within that console. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a remotely exploitable, low-complexity flaw that yields complete compromise of the component's confidentiality, integrity, and availability once a low-privileged user authenticates. No CWE is provided in the source data, so the precise root-cause class (for example injection, authorization bypass, or insecure deserialization) cannot be confirmed from available intelligence; the EUVD entry (EUVD-2026-79691) mirrors the Oracle advisory rather than adding independent technical detail. Because exploitation requires a valid low-privilege authenticated session (PR:L) and no user interaction (UI:N), the practical attack surface is bounded by who can obtain an EBS account and reach the Oracle Applications Manager endpoint over the network.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 8.8 HIGH

Network HTTP with low complexity and no user interaction; a low-privileged account is required (PR:L), and component takeover justifies C:H/I:H/A:H with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive ViewAI

Why It Matters

Oracle E-Business Suite versions 12.2.3 through 12.2.15 are affected by a high-severity vulnerability in Oracle Applications Manager's Diagnostics Interfaces component, enabling an authenticated low-privileged attacker to achieve full takeover with high impact to confidentiality, integrity, and availability. Organizations running these versions-especially those with many low-trust users or internet-accessible instances-face significant risk of data breach, financial fraud, and operational disruption. No vendor-released patch identified at time of analysis; a fix is anticipated in Oracle's September 2026 Critical Patch Update.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis; interim mitigations include restricting network access to Oracle Applications Manager and Diagnostics Interfaces to trusted IP ranges, enforcing least privilege by minimizing low-privileged accounts, enabling detailed logging and monitoring for suspicious activity, and deploying WAF rules to block anomalous requests.

Threat Intelligence Overview

EPSS Score

0.4%

Top 62% exploitable

Prevalence

Medium

Major enterprise ERP suite, common in large organizations but not universal

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.