Oracle Applications Manager EUVD-2026-37249

Attacker must hold valid credentials for any low-privileged Oracle E-Business Suite 12.2 account (PR:L) and must be able to reach the Oracle Applications Manager web interface over HTTP, which is exposed by the EBS middle tier on installations of versions 12.2.3 through 12.2.15 with the Internal Operations component deployed (the default for supported EBS 12.2). No user interaction is required (UI:N) and attack complexity is low (AC:L), so any reachable OAM endpoint with a working low-privilege login is sufficient. Limiting factors are therefore the network exposure of the OAM URL (often internal-only behind a reverse proxy) and the need for at least one valid functional account; instances that have already been upgraded past 12.2.15 or that block non-admin users from OAM endpoints are out of scope.

Signals are mixed in priority. The CVSS 9.9 with scope change, network attack vector, low complexity, and only low privileges required is essentially the worst plausible authenticated score and indicates that any user with a basic application account can fully take over OAM and meaningfully damage adjacent EBS products. There is no EPSS score, KEV listing, or SSVC decision data in the provided intelligence, and no public POC is referenced, so likelihood of opportunistic mass exploitation is presently unquantified. Because EBS instances commonly issue large numbers of low-privileged functional accounts and are often reachable from internal corporate networks (and sometimes the internet via reverse proxies), the practical exposure is high even without confirmed in-the-wild abuse. Defenders should not wait for KEV inclusion before patching: the combination of PR:L, scope change, and Oracle's own 9.9 rating from a vendor that historically under-rates rather than over-rates makes this an immediate-priority fix.

An attacker phishes or otherwise obtains the credentials of any low-privileged EBS user, or uses an existing functional account, logs in to the Applications Manager URL over HTTP/HTTPS from the corporate network, and sends a crafted request to the Internal Operations component. The request escapes OAM's authorization boundary (scope change), giving the attacker administrative control of Oracle Applications Manager and the ability to manipulate, read, or disrupt connected EBS components such as concurrent managers and middle-tier services. No public exploit identified at time of analysis, but the low complexity and low privilege bar make reliable weaponization straightforward once technical details are reverse-engineered from the June 2026 CPU patch.