EUVD-2026-106310
GHSA-83j3-6hr3-v7p5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged EBS user
-
ExploitSend crafted HTTP request to Diagnostics component
-
ExecutionSatisfy high-complexity preconditions
-
ImpactRead subset of Applications Manager data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privileged authenticated account on Oracle E-Business Suite with network HTTP access to the Oracle Applications Manager Diagnostics component (versions 12.2.3 through 12.2.15). Exploitation is explicitly rated 'difficult to exploit' (AC:H), meaning the attacker must meet additional preconditions beyond the authenticated session; impact is limited to unauthorized read access to a subset of Applications Manager data, with no integrity or availability impact. The authentication requirement (PR:L) and high attack complexity are the primary limiting factors reducing realistic risk below what the network vector alone might suggest. |
| Impact | This is a low-severity issue that is NOT a real-world priority despite being network-exploitable. The CVSS 3.1 base score is only 3.1, and the vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) tells a consistent story: although reachable over HTTP, exploitation is 'difficult' (AC:H), requires an already-authenticated low-privileged account (PR:L), and yields only partial confidentiality impact (C:L) with no integrity or availability effect. No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active exploitation or weaponization. The one notable conflict is in the metadata: the input carries an 'Authentication Bypass' tag, which directly contradicts both the CVSS vector (PR:L requires valid privileges) and the description ('low privileged attacker') - this tag appears mislabeled and should not drive prioritization. Overall, treat this as a routine patch-cycle item (Oracle October 2026 CPU) rather than an emergency. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged, authenticated account on an Oracle E-Business Suite instance crafts specific HTTP requests to the Oracle Applications Manager Diagnostics component to read a limited subset of data they should not be able to view. The high attack complexity (AC:H) means the attacker must satisfy additional non-trivial conditions beyond simply sending a request. No public proof-of-concept exploit has been identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Low-privileged authenticated users of Oracle E-Business Suite 12.2.3 through 12.2.15 can read a limited subset of Oracle Applications Manager Diagnostics data over HTTP, with no integrity or availability impact. The assessed vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) and Oracle's 'difficult to exploit' rating mean an attacker needs a valid low-privileged account plus additional preconditions, keeping realistic risk low. No public exploit code was identified at time of analysis.
RemediationAI
Apply the Oracle Critical Patch Update referenced at https://www.oracle.com/security-alerts/cpuoct2026.html for Oracle E-Business Suite 12.2.3-12.2.15; patch status is 'Patch available per vendor advisory', and the exact fixed build is not specified in the provided data, so confirm the target version with Oracle Support before rollout. Until patched, restrict HTTP access to Oracle Applications Manager Diagnostics endpoints to trusted administrative networks, review and minimize low-privileged E-Business Suite accounts that can reach the component, and monitor for anomalous read activity; these controls reduce exposure but can break legitimate diagnostics and administration workflows and require access-control exceptions to be managed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle E-Business Suite is a suite of enterprise applications; Oracle Applications Manager is its management and monitoring console, and the Diagnostics component exposes HTTP-accessible diagnostic functions. The authoritative vector is AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N, so the flaw is remotely reachable over HTTP but requires a valid low-privileged session and high attack complexity-conditions beyond simply reaching the endpoint-before limited confidentiality data can be read; integrity and availability are unaffected. No CWE is supplied, so the precise coding defect is undisclosed, and the 'Authentication Bypass' tag should not be read as unauthenticated access because the assessed vector explicitly requires PR:L. EUVD confirms the same affected range, Oracle Applications Manager 12.2.3 ≤12.2.15.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Network HTTP reachability (AV:N) but difficult exploitation (AC:H) and a required low-privileged account (PR:L); only a partial-confidentiality read with no integrity or availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Applications Manager accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB