EUVD-2026-106308
GHSA-p2c9-qp3q-c9g4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged EBS account
-
ExploitSend crafted HTTP request to Diagnostics component
-
ExecutionTrigger flaw in Oracle Applications Manager
-
ImpactRead subset of accessible data or cause partial DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess a low-privileged authenticated account on the Oracle Applications Manager (PR:L) and to reach the Diagnostics component over HTTP. Oracle explicitly characterizes the flaw as difficult to exploit (AC:H), indicating success depends on specific, non-trivial conditions rather than a straightforward request. No end-user interaction is needed (UI:N). Affected deployments are Oracle E-Business Suite / Oracle Applications Manager versions 12.2.3 through 12.2.15; instances outside this range or already patched via the October 2026 CPU are not exposed. Impact is inherently bounded - only a subset of data is readable and only a partial denial of service is achievable. |
| Impact | This is a genuinely low-priority issue despite being network-reachable. The CVSS 3.1 base score of 4.2 (MEDIUM) accurately reflects a constrained vulnerability: AV:N gives remote HTTP reach, but AC:H (Oracle explicitly states 'difficult to exploit') and PR:L (requires an existing low-privileged authenticated account) substantially raise the bar, while impact is limited to C:L (read of a subset of data) and A:L (partial DoS) with no integrity impact (I:N). No EPSS score was provided, there is no CISA KEV listing, and no public exploit was identified, so all three exploitation-likelihood signals are either absent or negative and reinforce one another rather than conflict. No SSVC decision data was supplied. The combination of required authentication, high attack complexity, and only partial confidentiality/availability impact means this is a high-CVSS-but-no - rather, a correctly-scored medium - issue that does not warrant emergency patching, though it should be rolled into the normal Oracle Critical Patch Update (October 2026) cycle given the broad enterprise footprint of E-Business Suite. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged account on an Oracle E-Business Suite instance crafts specially-tuned HTTP requests to the Oracle Applications Manager Diagnostics component to read a limited subset of otherwise-protected data or to degrade the manager's availability. Because Oracle rates the flaw as difficult to exploit (AC:H), success is not reliable and likely requires specific timing or conditions. No public proof-of-concept exploit has been identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Limited data disclosure and partial denial of service in Oracle Applications Manager (Oracle E-Business Suite) allow a low-privileged authenticated attacker with HTTP network access to the Diagnostics component to read a subset of accessible data and degrade availability. Affected releases are 12.2.3 through 12.2.15; Oracle rates exploitation as difficult (AC:H) and the CVSS 3.1 score is 4.2, so this is a low-priority issue. No public exploit code or CISA KEV entry is identified in the supplied intelligence.
RemediationAI
Apply the Oracle October 2026 Critical Patch Update using the vendor advisory at https://www.oracle.com/security-alerts/cpuoct2026.html; patch status is 'patch available per vendor advisory,' and the exact patched build/version for each 12.2.3-12.2.15 release is not specified in the provided data. Verify the installed Applications Manager version and test the CPU in a non-production environment before rollout. If patching must be staged, restrict HTTP access to the Applications Manager Diagnostics component to trusted administrative networks, which lowers exposure but can disrupt legitimate remote administration; review and remove unused low-privileged accounts, which reduces the required foothold but requires account-governance effort; and alert on Diagnostics access by low-privileged users, recognizing that monitoring is detective only and does not block exploitation. No public exploit code or KEV-listed active exploitation is identified, so emergency out-of-band action is not indicated by the supplied intelligence.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Applications Manager is the web-based management console within Oracle E-Business Suite, and the affected Diagnostics component is reached over HTTP. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L shows network reachability, high attack complexity, low privileges required, no user interaction, unchanged scope, and only low confidentiality and low availability impact. Oracle does not assign a CWE in the provided data and does not disclose the precise defect class, so the root cause should be treated as a bounded access/availability weakness in Diagnostics rather than a confirmed memory-safety or injection flaw. Exploitation requires an existing low-privileged account and non-trivial conditions; instances outside 12.2.3-12.2.15 or patched via the October 2026 CPU are not exposed.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L
Remote HTTP reach (AV:N) but Oracle states it is difficult to exploit (AC:H) and a low-privileged account is required (PR:L); impact limited to partial read (C:L) and partial DoS (A:L), no integrity.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Applications Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Applications Manager. CVSS 3.1 Base Score 4.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB