What is the CVSS score of EUVD-2026-47087?

EUVD-2026-47087 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Oracle Applications Manager are affected by EUVD-2026-47087?

Oracle Applications Manager in E-Business Suite versions 12.2.3-12.2.15 can be completely compromised through the RapidClone component by any actor with server-level access, without requiring…

How to fix or mitigate EUVD-2026-47087?

Within 24 hours, identify all systems running Oracle E-Business Suite versions 12.2.3 through 12.2.15 and document which personnel hold host-level access to RapidClone; simultaneously audit recent host access logs for any unauthorized activity or privilege escalation. Within 7 days, implement immediate mitigations by restricting RapidClone host-level access to named system administrators only through OS-level controls, disabling the RapidClone component if operationally feasible, and enabling host-based monitoring of RapidClone process execution. Within 30 days, continuously monitor Oracle's Critical Patch Updates for patch availability and establish a timeline to upgrade to post-12.2.15 versions or deploy a compensating architecture that isolates the vulnerable component.

Oracle Applications Manager EUVD-2026-47087

| CVE-2026-60763 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-c5fg-prhw-hj9c

Authentication Bypass Oracle Applications Manager

8.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.4 HIGH

Requires local logon to the EBS host so AV:L, but no OAM application credential (PR:N) and low complexity; full takeover yields C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:06 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.4

DescriptionCVE.org

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Applications Manager executes to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Applications Manager (a management console within Oracle E-Business Suite) is possible through the Command Line - RapidClone component in EBS versions 12.2.3 through 12.2.15. An attacker who already has logon access to the host infrastructure where the component runs can compromise it without any application-level authentication, gaining full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; it was disclosed by Oracle in the July 2026 Critical Patch Update.

Technical ContextAI

Oracle Applications Manager (OAM) is the systems-management and monitoring console bundled with Oracle E-Business Suite 12.2. The affected surface is the RapidClone command-line facility, Oracle's cloning/duplication tooling used to copy EBS instances (application tier and configuration). The CVSS vector (AV:L) indicates the weakness is reached through local logon rather than the network, consistent with a command-line utility rather than an HTTP endpoint. Oracle publishes no CWE for this entry (CWE: N/A), but the vendor's 'Information Disclosure' tag combined with full C/I/A impact suggests improper access control or privilege handling in the RapidClone command path that lets a local actor escalate to full control of OAM. Exact affected builds per Oracle span EBS 12.2.3 to 12.2.15.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); the input provides no discrete fix version beyond the CPU bundle, so patch per Oracle's CPU guidance for your EBS 12.2.x level - treat this as 'Patch available per vendor advisory.' Because the attack requires local logon to the application-tier host, the most effective compensating control until patching is to tightly restrict and audit interactive/OS-level access to EBS application servers: limit shell accounts, enforce least privilege on the RapidClone/adclone utilities and their file permissions, and monitor invocation of cloning commands. Avoid granting shared or broad logon access to the OAM host, and segregate cloning operations to dedicated administrators; the trade-off is added operational friction for legitimate cloning/administration workflows. Do not rely on network controls alone, as the vector is local rather than network-facing.