Oracle Applications Manager CVE-2026-91532

Exploitation requires network access via HTTP to the Oracle Applications Manager (Internal Operations component) of an Oracle E-Business Suite deployment running an affected version (12.2.3 through 12.2.15), plus a valid low-privileged account on that instance (CVSS PR:L) - it is NOT unauthenticated. No user interaction is required and attack complexity is low. The primary limiting factor is the need for an existing authenticated foothold; this constrains purely external, unauthenticated mass exploitation and makes insider access, credential compromise, or exposed self-service EBS portals the realistic entry points. No non-default configuration is called out by the vendor, so default affected installations appear exploitable once the attacker has low privileges.

This is a genuinely high-priority vulnerability by its intrinsic characteristics, though real-world exploitation signals are currently absent. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, yielding full confidentiality, integrity, and availability compromise - Oracle explicitly describes 'takeover of Oracle Applications Manager.' These are the hallmarks of an attractive post-authentication target. However, the available exploitation-maturity signals are weak or missing: there is no CISA KEV listing, no public exploit code identified, and no EPSS score was provided in the input, so the probability of imminent widespread exploitation cannot be quantified from this data. SSVC-style reasoning: exploitation status is 'none' (no evidence of active or public exploit), technical impact is 'total,' and automatability is plausibly 'yes' given AV:N/AC:L/UI:N, but the PR:L requirement means an attacker first needs some valid low-privileged foothold, which tempers mass automatability against unauthenticated internet scanning. One notable tension: the input Tag labels this 'Information Disclosure,' yet the description and CVSS (I:H/A:H plus full takeover) clearly indicate integrity and availability impact well beyond disclosure - treat the tag as understated, not the CVSS. Net: a real priority for any org running affected EBS versions, but current evidence points to it being a patch-on-schedule-and-prioritize item rather than a confirmed in-the-wild emergency.

A low-privileged user with valid access to an internet- or intranet-facing Oracle E-Business Suite instance sends crafted HTTP requests to the Oracle Applications Manager (Internal Operations component) to escalate to full control of the Applications Manager. Because attack complexity is low and no user interaction is needed, a single authenticated session is sufficient to achieve complete compromise of confidentiality, integrity, and availability. No public proof-of-concept exploit has been identified at the time of analysis.