Description
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications Manager. While the vulnerability is in Oracle Applications Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
Published: 2026-09-15
Score: 8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

This vulnerability in Oracle Applications Manager’s RapidClone command line component permits a high‑privilege attacker with network access via HTTP to take over the Applications Manager instance. The flaw falls under CWE‑284 (Improper Access Control) and can lead to full compromise of confidentiality, integrity, and availability.

Affected Systems

Affected versions span Oracle Applications Manager 12.2.3 through 12.2.15, part of Oracle E‑Business Suite. The product is supplied by Oracle Corporation.

Risk and Exploitability

The CVSS v3.1 base score of 8.0 signals high severity. The EPSS value of less than 1 % indicates a low probability of active exploitation at present, yet the potential for complete system takeover remains serious. The vulnerability is not listed in CISA KEV, but add‑on scope changes could impact other Oracle products if the compromise is achieved.

Generated by OpenCVE AI on September 20, 2026 at 10:19 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any available Oracle patch for CVE‑2026‑83157 to all affected systems
  • Restrict HTTP access to the Applications Manager server to trusted hosts or internal networks only
  • Consider disabling the RapidClone command line feature if it is not required for business operations

Generated by OpenCVE AI on September 20, 2026 at 10:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 10:45:00 +0000

Type Values Removed Values Added
Title High‑Impact Access Control Failure Enabling Remote Compromise in Oracle Applications Manager

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via RapidClone Command Line in Oracle Applications Manager
Weaknesses CWE-77

Thu, 17 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 17 Sep 2026 02:00:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via RapidClone Command Line in Oracle Applications Manager
Weaknesses CWE-77

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications Manager. While the vulnerability is in Oracle Applications Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
First Time appeared Oracle
Oracle applications Manager
CPEs cpe:2.3:a:oracle:applications_manager:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle applications Manager
References
Metrics cvssV3_1

{'score': 8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Oracle Applications Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-17T15:17:21.822Z

Reserved: 2026-08-31T15:40:57.343Z

Link: CVE-2026-83157

cve-icon Vulnrichment

Updated: 2026-09-17T14:58:39.589Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:26.553

Modified: 2026-09-17T16:18:05.857

Link: CVE-2026-83157

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T10:30:17Z

Weaknesses