EUVD-2026-79484
GHSA-4jgj-jmqp-633q
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 15, 2026
Command-line processing in Oracle Applications Manager, a component of Oracle E-Business Suite 12.2.3 through 12.2.15, can be abused by a high-privileged attacker with network access over HTTP to take full control of the Applications Manager host and, because of a scope change, to significantly impact other linked EBS products. Oracle's own vector (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) indicates that exploitation is difficult and requires an already-elevated account (a privileged operator, administrator, or equivalent account with access to the RapidClone command-line functionality), and no public exploit code or CISA KEV listing has been identified at time of analysis. No EPSS score was supplied with the source data, so the probability of real-world exploitation cannot be quantified from the available intelligence.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Primary rating from Vendor (oracle) · only source for this CVE.
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications Manager. While the vulnerability is in Oracle Applications Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
Executive ViewAI
Oracle E-Business Suite deployments running Applications Manager (versions 12.2.3 through 12.2.15) are exposed to a high-severity flaw that allows an already-privileged operator to seize full control of the Applications Manager host and, through a scope change, extend that impact into interconnected EBS products. Because the affected component is central to EBS administration, a successful compromise could disrupt finance, supply chain, and HR processes that depend on the suite, and no vendor patch is currently available. Leadership should treat this as a supply-chain-critical risk and prioritize containment and monitoring until Oracle releases a fix.
Within 24 hours, confirm which of your EBS environments run Applications Manager 12.2.3 through 12.2.15, restrict network access to the Applications Manager HTTP interfaces so only trusted administrative subnets can reach them, and audit accounts holding RapidClone command-line privileges to ensure they are limited to the smallest possible set of administrators. Within 7 days, apply network segmentation to isolate EBS application tiers from general corporate networks, enable detailed logging and alerting on Applications Manager command-line activity and administrative sessions, and review privilege assignments for unnecessary elevated roles. Within 30 days, establish a recurring review of Oracle's Critical Patch Update and security advisory channels so the vendor patch is deployed immediately upon release, validate that compensating controls remain enforced through configuration baselines, and rehearse incident response for full host takeover of an EBS application tier. Vendor-released patch: none identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network reachability to Applications Manager HTTP endpoints via firewall rules and administrative VLANs; enforce least privilege and strong authentication for accounts with RapidClone command-line access; segment EBS application hosts from other corporate networks; enable and monitor audit logging of administrative and command-line activity; and prepare containment procedures for host takeover given the potential to affect linked EBS products.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB