EUVD-2026-105961
GHSA-r6xf-3c63-99h7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Oracle Applications Manager endpoint
-
ExploitSend crafted unauthenticated HTTP request
-
ExecutionExploit Diagnostics Interfaces flaw
-
ImpactExfiltrate critical application data
Vulnerability Assessment
| Exploitation Conditions | Exploitation targets the Oracle Diagnostics Interfaces component of Oracle Applications Manager within Oracle E-Business Suite versions 12.2.3 through 12.2.15; the attacker needs only HTTP/network reachability to the Oracle Applications Manager interface. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special non-default configuration are stated as required - so the primary limiting factor is network exposure: instances restricted to internal networks or placed behind access controls/VPNs are far less reachable than internet-facing deployments. Impact is confined to unauthorized read access to Oracle Applications Manager data (C:H); there is no integrity or availability impact. |
| Impact | CVSS 3.1 base score is 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating a network-reachable, low-complexity, unauthenticated attack affecting only confidentiality. This profile is genuinely concerning because no privileges or user interaction are required, which favors opportunistic scanning and mass exploitation of internet-exposed Oracle E-Business Suite instances. However, the real-world risk picture is incomplete: no EPSS exploitation-probability score was provided, the vulnerability is NOT listed in CISA KEV, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. No SSVC decision data was supplied. The signals are therefore consistent rather than conflicting (high theoretical exploitability, but no evidence of active exploitation yet); this should be treated as a patch-priority item for internet-facing EBS deployments given Oracle's broad enterprise footprint and the historical targeting of EBS, while recognizing that current exploitation evidence is absent and the impact is confidentiality-only (no integrity or availability loss). |
| Exploit ScenarioDerived | An attacker locates an internet-exposed Oracle Applications Manager endpoint and sends a crafted HTTP request to the Oracle Diagnostics Interfaces component without any credentials. Because the flaw requires no authentication, no user interaction, and low attack complexity, the attacker retrieves critical data accessible to Oracle Applications Manager. No public proof-of-concept exploit is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthenticated network attackers can read sensitive Oracle Applications Manager data in Oracle E-Business Suite 12.2.3 through 12.2.15 through the Oracle Diagnostics Interfaces component. The vulnerability is remotely reachable over HTTP with low attack complexity and no credentials or user interaction required, yielding a CVSS 3.1 score of 7.5 with confidentiality-only impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and exposure is primarily limited by whether the Applications Manager interface is network-accessible.
RemediationAI
Oracle's October 2026 Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpuoct2026.html) is the vendor reference for fixes; the provided data does not specify an exact fixed version, so confirm the patched release in that advisory before upgrading Oracle E-Business Suite/Oracle Applications Manager. Until patched, restrict network access to the Oracle Applications Manager and Oracle Diagnostics Interfaces endpoints using firewall allowlists, VPN, or reverse-proxy authentication so that only trusted management networks can reach them-trading off administrative convenience for reduced exposure. If the diagnostics interfaces are not required, disable or block them at the network and application layers, and monitor HTTP access logs for unauthenticated requests to diagnostics paths; disabling may break monitoring or support workflows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle E-Business Suite is a suite of enterprise applications; Oracle Applications Manager provides management, monitoring, and diagnostics capabilities, and its Oracle Diagnostics Interfaces component exposes HTTP endpoints used for diagnostic data collection and reporting. The provided CWE is N/A and no CPE mapping was supplied, so the precise implementation flaw is not documented in the input; the tags characterize it as an authentication bypass, and the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates that the root cause allows network-reachable requests to bypass intended access controls and read data without authentication or user interaction. There is no stated integrity or availability impact, and exploitation does not require special non-default configuration per the assessment; the practical constraint is network reachability to the Applications Manager interface.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated HTTP access to Oracle Applications Manager gives AV:N/AC:L/PR:N/UI:N; impact is read-only data disclosure, so C:H with I:N/A:N.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Executive ViewAI
Oracle E-Business Suite 12.2.3 through 12.2.15 deployments that expose Oracle Applications Manager's Diagnostics Interfaces face a high-severity confidentiality risk, potentially allowing sensitive application data to be read by network parties who can reach the component. No vendor-released patch is identified at time of analysis and no public exploit was identified at time of analysis, so leadership should prioritize reducing external exposure and inventorying affected systems.
Restrict Oracle Applications Manager/Diagnostics Interfaces to trusted networks, disable or block external access, enforce firewall and ACL rules, monitor HTTP access and logs for data-read attempts, and review access to sensitive application data; no vendor-released patch identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB