Oracle E-Business Suite EUVD-2026-79694

No special conditions beyond network reachability of the Oracle Applications Manager HTTP endpoint on an affected Oracle E-Business Suite 12.2.3-12.2.15 installation: the CVSS vector is AV:N/AC:L/PR:N/UI:N, so no credentials and no user interaction are required. What limits real-world exploitation is exposure and version, not configuration - the Applications Manager listener must be reachable from the attacker's network position, and many enterprises place it behind restricted firewall rules or an internal-only VLAN, which is the single most important factor in assessing actual risk. The privileged information reachable is bounded to what Applications Manager itself can access (C:H/I:N/A:N), so no integrity or availability impact should be expected. The input does not confirm whether the RapidClone feature must be enabled or whether any specific endpoint path is required - that detail is missing and should be verified against the Oracle advisory.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) describes the easiest possible exploitation profile: network reachable, low complexity, no authentication, no user interaction, with full confidentiality loss scoped to Applications Manager. The 'Authentication Bypass' tag is consistent with a pre-auth access path, though the input does not name the specific missing check. Weighing against that severity: no EPSS score was provided, no CISA KEV entry was supplied, and no POC reference appears in the data - so this cannot be asserted as actively exploited. Exploitation also requires the Applications Manager HTTP endpoint to be reachable, which many organizations restrict to internal networks, materially reducing real-world exposure versus a default-internet-facing service. Practically, this is a priority for any organization running internet- or DMZ-exposed EBS 12.2.x, and a routine-but-real issue for instances confined to trusted networks. Confidence in the severity rating is high because both the description and the vector agree; confidence in exploitation status is explicitly low because the input is silent on KEV/EPSS/POC.

An attacker who can reach the Applications Manager HTTP port sends crafted requests targeting the RapidClone command-line interface, skipping authentication and returning Applications Manager configuration and management data. Because no credentials or user interaction are needed and the attack is low complexity, the activity is indistinguishable from ordinary HTTP traffic and is well suited to automated mass scanning of exposed EBS consoles. The attacker then uses harvested configuration details - connection strings, topology, and internal hostnames - to plan follow-on lateral movement.