EUVD-2026-106300
GHSA-qfgm-fxr5-xv7w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged EBS account
-
ExploitSend crafted HTTPS request to Report Manager
-
ExecutionBypass data access controls
-
ImpactRead unauthorized report data subset
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated low-privileged account on the target Oracle Report Manager instance (component: Internal Operations) within Oracle E-Business Suite 12.2.3 through 12.2.15, reachable over HTTPS. No user interaction is needed (UI:N) and attack complexity is low (AC:L), but the mandatory PR:L authentication requirement is the primary limiting factor - an anonymous/unauthenticated attacker cannot exploit this. Impact is limited to reading a subset of Report Manager data; no write/modify or denial-of-service capability is present. |
| Impact | This is a moderate, low-priority issue despite its enterprise footprint. The CVSS 3.1 base score of 4.3 (vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects a network-reachable but authenticated flaw: the attacker must already hold low-level privileges (PR:L), and the only consequence is unauthorized read access to a subset of Report Manager data (C:L, with no integrity or availability impact). There is no EPSS score, no CISA KEV listing, and no public proof-of-concept provided in the input, so there is no signal of active or imminent exploitation - this reads as a routine Oracle Critical Patch Update confidentiality fix rather than an urgent threat. Note a conflict in the metadata: the input carries an 'Authentication Bypass' tag, but the CVSS vector explicitly requires PR:L (an authenticated low-privileged account) and yields only partial confidentiality impact, which is inconsistent with a true authentication bypass - the tag appears mislabeled and should not drive prioritization. Overall this is a genuine but low-severity information-disclosure bug; patch it in the normal Oracle CPU cycle rather than as an emergency. |
| Exploit ScenarioDerived | An attacker who already possesses a valid low-privileged Oracle E-Business Suite account sends crafted HTTPS requests to the Report Manager interface and retrieves a subset of report data they should not be able to view. No public exploit code was identified in the provided data, and exploitation yields read-only disclosure with no ability to modify data or disrupt service. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Oracle Report Manager, a component of Oracle E-Business Suite (Internal Operations), exposes a subset of its data to unauthorized reading by a low-privileged, authenticated user who can reach the application over HTTPS. Versions 12.2.3 through 12.2.15 are affected; no public exploit code or confirmed active exploitation was identified at the time of analysis, and the CVSS 3.1 score of 4.3 reflects confidentiality-only impact with no integrity or availability effect. Because exploitation requires valid low-privileged credentials (PR:L) and low attack complexity with no user interaction, the practical risk is concentrated in environments where many low-trust accounts exist or where account provisioning is loosely controlled.
RemediationAI
Apply the fix published in Oracle's October 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuoct2026.html); the advisory is the vendor's authoritative remediation vehicle and should be applied to bring E-Business Suite 12.2.3-12.2.15 to the CPU-applicable patch level, since no discrete fix version number is published in the available data. If patching must be deferred, reduce exposure with targeted controls: restrict HTTPS access to Oracle Report Manager endpoints (for example via reverse-proxy ACLs or network segmentation) to trusted user populations - trade-off is reduced remote usability for legitimate reporting users; audit and prune low-privileged E-Business Suite accounts and enforce least privilege on Report Manager responsibilities - trade-off is administrative overhead and possible workflow disruption for staff who relied on broad access; and enable verbose logging/alerting on anomalous Report Manager read patterns for low-privileged sessions - trade-off is log volume and tuning effort, but it provides detection coverage while the CPU is pending. Note that no vendor workaround is documented in the available references, and no public exploit exists, so remediation can follow normal quarterly patch cadence rather than emergency change procedures.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in the Internal Operations component of Oracle Report Manager, the reporting and output-management module delivered within Oracle E-Business Suite 12.2.x. With no CWE assigned by the vendor, the root cause is best characterized from the assessed CVSS vector: a missing or insufficient authorization check (AV:N/AC:L/PR:L/UI:N/S:U/C:L) that lets a holder of a low-privileged account request Report Manager resources beyond their intended data scope over HTTPS. The 'Authentication Bypass' tag on this record should be read as an access-control/authorization weakness rather than a pre-authentication bypass - the authoritative assessment confirms PR:L, meaning an anonymous attacker cannot trigger it. Impact is confined to reading a limited portion of Report Manager-accessible data within the unchanged (S:U) security scope; there is no write, modification, or denial-of-service path described. Exploitation is deterministic rather than probabilistic (AC:L, UI:N), so any low-privileged user who knows the relevant HTTPS endpoint can attempt it repeatedly.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network HTTPS reach (AV:N) and low complexity (AC:L), but a valid low-privileged EBS account is required (PR:L); only partial read disclosure, so C:L with I:N/A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Report Manager. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Report Manager accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB