Description
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Applications Manager executes to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Applications Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-09-15
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

The vulnerability lies in the RapidClone command‑line tool of Oracle Applications Manager. It allows a low‑privileged local user to exploit a misconfigured privilege check and take full control of the Applications Manager installation. Successful exploitation leads to unauthorized creation, deletion, or modification of critical data, thereby compromising confidentiality and integrity. The weakness is tied to improper permission checks (CWE-284) and is quantified by a CVSS v3.1 Base Score of 7.1 with high confidentiality and integrity impact.

Affected Systems

Oracle Corporation’s Oracle Applications Manager product, versions 12.2.3 through 12.2.15, is affected. The vulnerability is confined to the RapidClone component, but any deployment of these versions exposes the installation to the threat.

Risk and Exploitability

The flaw is local and requires only low privileges, with no user interaction. This makes exploitation straightforward for an attacker who has host access. The CVSS score of 7.1 classifies the issue as high severity, although the EPSS score of less than 1 % indicates a very low probability of exploitation at this time, and it is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on September 20, 2026 at 09:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle patch that addresses the RapidClone privilege escalation flaw in versions 12.2.3 to 12.2.15.
  • Restrict operating‑system permissions for accounts that can access the Oracle Applications Manager the RapidClone tool.
  • Disable or remove the RapidClone feature if it is not required for business operations to reduce the attack surface.

Generated by OpenCVE AI on September 20, 2026 at 09:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation in Oracle Applications Manager via RapidClone
Weaknesses CWE-285
CWE-730

Thu, 17 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 17 Sep 2026 02:00:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation in Oracle Applications Manager via RapidClone
Weaknesses CWE-285
CWE-730

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Applications Manager executes to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Applications Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle applications Manager
CPEs cpe:2.3:a:oracle:applications_manager:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle applications Manager
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Applications Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-17T15:17:16.203Z

Reserved: 2026-08-31T15:40:57.343Z

Link: CVE-2026-83158

cve-icon Vulnrichment

Updated: 2026-09-17T14:58:38.604Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:26.670

Modified: 2026-09-17T16:18:05.997

Link: CVE-2026-83158

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T09:30:18Z

Weaknesses