EUVD-2026-106306
GHSA-vj75-vp9h-xm5w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain high-privileged OAM account
-
ExploitCraft complex HTTP request to Diagnostics
-
ExecutionTrigger unauthorized read
-
ImpactExfiltrate subset of data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess a high-privileged account on Oracle Applications Manager (PR:H) and to reach the Diagnostics component over HTTP. The CVSS AC:H rating indicates success depends on conditions outside the attacker's control (e.g., timing, specific state, or configuration), making reliable exploitation difficult. Impact is strictly limited to reading a subset of OAM-accessible data (C:L); there is no write/integrity or availability impact, and no unauthenticated path exists. These privilege and complexity requirements are the primary limiting factors and sharply reduce realistic risk below what 'network vector' alone might suggest. |
| Impact | This is a genuinely low-priority issue despite being network-reachable. The CVSS 3.1 base score is only 2.2, and the vector (AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) tells a consistent story: although the attack vector is network/HTTP, exploitation is rated high complexity (AC:H) AND requires a high-privileged account (PR:H), with impact limited to unauthorized read access to a subset of data (C:L) and no integrity or availability impact. No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of exploitation interest. The signals do not conflict - a high-privilege, high-complexity, confidentiality-only weakness is correctly a low real-world risk, not a high-CVSS-but-overblown case. Note one metadata conflict: the input Tags label this 'Authentication Bypass,' which contradicts the PR:H requirement and the limited read-only impact (an auth bypass would typically imply PR:N and broader access) - the tag appears mislabeled and should not drive prioritization. |
| Exploit ScenarioDerived | An attacker who already holds a high-privileged Oracle Applications Manager account leverages a complex, network-delivered HTTP request against the Diagnostics component to read a limited subset of data they should not be able to access. No public exploit code is identified, and the high attack complexity plus the pre-existing privilege requirement make opportunistic exploitation unlikely. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Limited read-only data exposure in Oracle Applications Manager (the Diagnostics component of Oracle E-Business Suite 12.2.3 through 12.2.15) is reachable over HTTP but only by an attacker who already holds a high-privileged OAM account, and exploitation additionally depends on conditions outside the attacker's control (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N, base score 2.2). Successful abuse yields unauthorized read access to a subset of OAM-accessible data with no integrity or availability impact and no unauthenticated path. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; the high privilege prerequisite and high attack complexity keep realistic risk well below what the network vector alone suggests.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 to Oracle E-Business Suite 12.2.3-12.2.15 as described at https://www.oracle.com/security-alerts/cpuoct2026.html; the provided data does not state a specific patched bundle or version number, so confirm the exact EBS/OAM patch level against the CPU advisory and My Oracle Support before scheduling. Because exploitation requires a high-privileged OAM account, the highest-value compensating control is privilege minimization: audit and reduce accounts holding administrative access to Applications Manager and remove diagnostics entitlements from users who do not require them, accepting that this may slow legitimate troubleshooting. In parallel, restrict network reachability of the OAM console and its Diagnostics endpoints to trusted administrator subnets or a management VLAN via firewall rules or a reverse-proxy allowlist, with the trade-off that remote administrators will require VPN or jump-host access. If the Diagnostics features are not actively used, disable or block access to those endpoints at the web tier; this removes the attack surface but may impair support workflows that depend on diagnostics collection. Enable and review HTTP access logging and audit trails for OAM Diagnostic requests by high-privileged users so that anomalous reads can be detected, noting the storage and review overhead this introduces. No vendor-released patch version is identified in the provided data beyond the referenced CPU, and there is no public exploit code, so emergency out-of-band action is not warranted.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Applications Manager is the web-based management and diagnostics console bundled with Oracle E-Business Suite, served over HTTP and used by administrators to inspect application-tier status, logs, and diagnostic information. The flaw sits in the Diagnostics component, which surfaces internal OAM state to authenticated console users; the assessed root cause permits a high-privileged user to read a subset of data beyond their intended visibility (confidentiality-only, C:L). No CWE identifier was supplied by the reporter, so classification is inferred from the assessed vector rather than a vendor-declared weakness class. The CVSS 3.1 vector AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N indicates the attacker must already be authenticated with high privileges (PR:H), must reach the Diagnostics functionality over the network, and must satisfy conditions such as specific application state, timing, or configuration (AC:H) before the read succeeds; scope is unchanged and no user interaction is required. Notably, the source-supplied tag "Authentication Bypass" is inconsistent with the authoritative assessment, which describes an authenticated, high-privilege, read-only exposure rather than a bypass of authentication; the tag should not be relied upon for triage. Cross-referenced identifiers: EUVD-2026-106306, reported by secalert_us@oracle.com.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
Network HTTP reach gives AV:N, but Oracle rates it difficult-to-exploit (AC:H) and high-privilege-only (PR:H), with only limited confidentiality impact (C:L) and no I/A.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Applications Manager accessible data. CVSS 3.1 Base Score 2.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB