CVE-2026-83115

Unauthenticated Remote Disclosure via RapidClone Command in Oracle Applications Manager

Published Sep 15, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Analysis

Technical impact

A flaw in the RapidClone command line component of Oracle Applications Manager allows an attacker with network access over HTTP to gain unauthorized access to all data that the application manages. The vulnerability has no authentication requirement and can be exploited directly from the network, resulting in potential disclosure of highly confidential information.

Affected Systems

Oracle Applications Manager versions 12.2.3 through 12.2.15, inclusive. The flaw applies to the RapidClone command line interface exposed via the HTTP interface of the product.

Risk and Exploitability

The CVSS 3.1 score is 7.5, indicating a high risk to confidentiality with no impact on integrity or availability. The EPSS score of < 1% suggests a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw by sending specially crafted HTTP requests to the RapidClone endpoint, enabling them to enumerate or retrieve sensitive data without requiring credentials.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

Oracle Applications Manager

affected

Version	Status	Constraints
`12.2.3`	affected	≤ 12.2.15

No data.

Vendor Product Versions

Oracle

Applications Manager

Version	Status	Scheme	Platform
`[12.2.3,12.2.15]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the most recent Oracle patch for Oracle Applications Manager 12.2.3 through 12.2.15 that addresses the RapidClone flaw.
Implement firewall or network segmentation rules to limit external HTTP access to the Oracle Applications Manager interface to trusted hosts only.
If RapidClone is not required for business functionality, disable the feature or enforce strict authentication and authorization controls to prevent unauthenticated usage.

Generated by OpenCVE AI on September 22, 2026 at 16:03 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.394% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://www.oracle.com/security-alerts/cspusep2026.html

History

Sep 22, 2026 4:30 PM Title updated View changes

Type	Values Removed	Values Added
Title		Unauthenticated Remote Disclosure via RapidClone Command in Oracle Applications Manager

Sep 22, 2026 2:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-1284 CWE-306

Sep 21, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 18, 2026 9:30 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	Unauthenticated Remote Access Vulnerability in Oracle Applications Manager RapidClone
Weaknesses	CWE-284

Sep 17, 2026 2:30 AM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		Unauthenticated Remote Access Vulnerability in Oracle Applications Manager RapidClone
Weaknesses		CWE-284

Sep 15, 2026 8:15 PM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
First Time appeared		Oracle Oracle applications Manager
CPEs		cpe:2.3:a:oracle:applications_manager::::::::
Vendors & Products		Oracle Oracle applications Manager
References		https://www.oracle.com/security-alerts/cspusep2026.html
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`