Description
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-09-15
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Access
Action: Immediate Patch
AI Analysis

Impact

A flaw in the RapidClone command line component of Oracle Applications Manager allows an attacker with network access over HTTP to gain unauthorized access to all data that the application manages. The vulnerability has no authentication requirement and can be exploited directly from the network, resulting in potential disclosure of highly confidential information.

Affected Systems

Oracle Applications Manager versions 12.2.3 through 12.2.15, inclusive. The flaw applies to the RapidClone command line interface exposed via the HTTP interface of the product.

Risk and Exploitability

The CVSS 3.1 score is 7.5, indicating a high risk to confidentiality with no impact on integrity or availability. The EPSS score of < 1% suggests a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw by sending specially crafted HTTP requests to the RapidClone endpoint, enabling them to enumerate or retrieve sensitive data without requiring credentials.

Generated by OpenCVE AI on September 22, 2026 at 16:03 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the most recent Oracle patch for Oracle Applications Manager 12.2.3 through 12.2.15 that addresses the RapidClone flaw.
  • Implement firewall or network segmentation rules to limit external HTTP access to the Oracle Applications Manager interface to trusted hosts only.
  • If RapidClone is not required for business functionality, disable the feature or enforce strict authentication and authorization controls to prevent unauthenticated usage.

Generated by OpenCVE AI on September 22, 2026 at 16:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 22 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Disclosure via RapidClone Command in Oracle Applications Manager

Tue, 22 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1284
CWE-306

Mon, 21 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Access Vulnerability in Oracle Applications Manager RapidClone
Weaknesses CWE-284

Thu, 17 Sep 2026 02:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Access Vulnerability in Oracle Applications Manager RapidClone
Weaknesses CWE-284

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle applications Manager
CPEs cpe:2.3:a:oracle:applications_manager:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle applications Manager
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Applications Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-30T15:10:18.885Z

Reserved: 2026-08-31T15:40:57.340Z

Link: CVE-2026-83115

cve-icon Vulnrichment

Updated: 2026-09-21T16:15:46.488Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:21.817

Modified: 2026-09-22T14:17:16.053

Link: CVE-2026-83115

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T16:15:08Z

Weaknesses
  • CWE-1284

    Improper Validation of Specified Quantity in Input

  • CWE-306

    Missing Authentication for Critical Function