Description
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Applications Manager executes to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Applications Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-09-15
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is in Oracle Applications Manager’s RapidClone command-line tool, allowing a low‑privileged local user to compromise the entire installation and gain unauthorized creation, deletion or modification of critical data, thereby affecting confidentiality and integrity. The CVSS v3.1 base score of 7.1 reflects high confidentiality and integrity impact.

Affected Systems

Oracle Corporation’s Oracle Applications Manager product, versions 12.2.3 through 12.2.15, is affected. The flaw is confined to the RapidClone component, but any deployment of these versions is at risk.

Risk and Exploitability

The flaw is local, requiring only low privileges and no user interaction, which makes exploitation straightforward for an attacker with host access. The CVSS score of 7.1 classifies it as high severity; however, the EPSS score of less than 1 % indicates a very low probability of exploitation at this time, and it is not listed in the CISA KEV catalog. Prompt mitigation is essential to prevent potential data loss or system compromise.

Generated by OpenCVE AI on September 17, 2026 at 01:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle patch that fixes the RapidClone command‑line privilege flaw in versions 12.2.3 to 12.2.15.
  • Restrict operating‑system permissions for accounts that can access the Oracle Applications Manager host, limiting their ability to run the RapidClone tool.
  • Disable or remove the RapidClone feature if it is not required for business operations to reduce the attack surface.

Generated by OpenCVE AI on September 17, 2026 at 01:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 17 Sep 2026 02:00:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation in Oracle Applications Manager via RapidClone
Weaknesses CWE-285
CWE-730

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Applications Manager executes to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Applications Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle applications Manager
CPEs cpe:2.3:a:oracle:applications_manager:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle applications Manager
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Applications Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-17T15:17:16.203Z

Reserved: 2026-08-31T15:40:57.343Z

Link: CVE-2026-83158

cve-icon Vulnrichment

Updated: 2026-09-17T14:58:38.604Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:26.670

Modified: 2026-09-17T16:18:05.997

Link: CVE-2026-83158

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T01:45:06Z

Weaknesses