Description
Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA. Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-09-15
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Applications DBA Compromise
Action: Immediate Patch
AI Analysis

Impact

Oracle E‑Business Suite Applications DBA has a vulnerability that allows an attacker with low privileges and local system access to compromise the Applications DBA utility. The flaw can lead to a full takeover of Applications DBA. The vulnerability carries confidentiality, integrity, and availability impacts as reflected in its CVSS 3.1 base score of 7.8.

Affected Systems

Affected products are Oracle Corporation Applications DBA within Oracle E‑Business Suite. Supported versions susceptible to the flaw are 12.2.3 through 12.2.15.

Risk and Exploitability

The CVSS score is 7.8, indicating high severity. The EPSS score is less than 1%, suggesting the exploitation probability is currently very low, but that does not negate the need for remediation. The vulnerability is not listed in the CISA KEV catalog. Attack requires local infrastructure logon and the ability to execute code within the Applications DBA process. Once reached, the attacker can execute any operation with the same privileges as the DBA utility.

Generated by OpenCVE AI on September 18, 2026 at 20:32 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch for Applications DBA to eliminate the vulnerability
  • Limit logon privileges on the infrastructure that hosts Applications DBA, restricting access to trusted administrators only
  • Configure firewall or network segmentation to block unnecessary inbound connections to the Applications DBA host

Generated by OpenCVE AI on September 18, 2026 at 20:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title Low‑Privilege Database Takeover via Applications DBA Vulnerability

Thu, 17 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 17 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269

Thu, 17 Sep 2026 03:00:00 +0000

Type Values Removed Values Added
Title Low‑Privilege Database Takeover via Applications DBA Vulnerability
Weaknesses CWE-284
CWE-770

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA. Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle applications Dba
CPEs cpe:2.3:a:oracle:applications_dba:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle applications Dba
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Applications Dba
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-17T12:49:33.870Z

Reserved: 2026-08-31T15:40:57.341Z

Link: CVE-2026-83118

cve-icon Vulnrichment

Updated: 2026-09-17T12:46:07.247Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:22.157

Modified: 2026-09-17T13:16:49.163

Link: CVE-2026-83118

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-18T20:45:14Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-284

    Improper Access Control

  • CWE-770

    Allocation of Resources Without Limits or Throttling