Oracle Applications Manager EUVD-2026-47087

Exploitation requires the attacker to already have interactive logon access to the infrastructure host where Oracle Applications Manager and its RapidClone command-line component execute (AV:L). No Oracle Applications Manager application credentials are required (PR:N) and no user interaction is needed (UI:N), and default configurations of the affected EBS 12.2.3-12.2.15 builds are exploitable once local access exists. The primary limiting factor is precisely that local/OS logon prerequisite: attackers without a shell or command-line session on the EBS application tier cannot reach this component remotely, which sharply reduces the realistic attacker set compared to a network-exploitable vulnerability.

The CVSS 3.1 base score is 8.4 (High), driven by full C:H/I:H/A:H impact with low attack complexity and no privileges or user interaction. The critical mitigating signal is AV:L - exploitation requires local logon to the infrastructure hosting OAM, not remote network reach, which materially narrows the attacker population versus a typical internet-facing 8.4. There is an apparent tension worth noting: the vector marks PR:N (no privileges) yet the description requires 'logon to the infrastructure,' meaning an attacker needs an OS-level foothold even though no OAM application credential is needed - Oracle models the OS access as the local vector (AV:L) rather than as a privilege (PR). No EPSS score, SSVC decision, KEV listing, or POC was provided, so exploitation probability cannot be quantified from the input. Net: a genuine high-severity issue for any organization where untrusted or lower-privileged users can obtain a shell on EBS application-tier hosts, but not a remote-unauthenticated 'drop everything' network exposure. Prioritize during the standard Oracle CPU patch cycle, escalating where local host access is broadly available.

An attacker with a low-privilege shell on an Oracle E-Business Suite 12.2 application-tier server - for example a compromised service account or a misused administrator/operator login - invokes the RapidClone command-line facility to trigger the flaw and take over Oracle Applications Manager, gaining full read/write control and the ability to disrupt operations. Because attack complexity is low and no OAM authentication is needed, the step from local foothold to OAM compromise is straightforward. No public proof-of-concept exploit has been identified at time of analysis.