Description
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-09-15
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution and Compromise of Oracle Applications Manager
Action: Immediate Patch
AI Analysis

Impact

Oracle Applications Manager includes a flaw in its Diagnostics Interfaces component. When a low‑privileged attacker accesses the HTTP interface, the vulnerability permits full compromise of the application, allowing the attacker to execute arbitrary code, exfiltrate data, and modify or delete resources. The impact covers confidentiality, integrity and availability, reflected in a CVSS 3.1 base score of 8.8.

Affected Systems

The affected product is Oracle Applications Manager, part of Oracle E‑Business Suite. Versions 12.2.3 through 12.2.15 are impacted. The flaw resides in the Diagnostics Interfaces service exposed over HTTP.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity, though the EPSS score is less than 1%, suggesting a low current exploitation likelihood. The vulnerability is not listed in CISA KEV. Attackers can exploit it remotely via HTTP with only low privileges, requiring no elevated permissions or prior authentication. Successful exploitation leads to complete takeover of the Oracle Applications Manager instance.

Generated by OpenCVE AI on September 20, 2026 at 07:34 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch that addresses the Diagnostics Interfaces issue.
  • If patch cannot be applied immediately, disable or remove the Diagnostics Interfaces feature to block attackers.
  • Restrict HTTP access to the Oracle Applications Manager web interface to trusted hosts or a VPN and enforce strong authentication.

Generated by OpenCVE AI on September 20, 2026 at 07:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 08:00:00 +0000

Type Values Removed Values Added
Title Oracle Applications Manager Remote Code Execution via Diagnostics Interfaces

Fri, 18 Sep 2026 15:15:00 +0000

Type Values Removed Values Added
Title Low‑Privileged Network Attack Allows Takeover of Oracle Applications Manager
Weaknesses CWE-284

Thu, 17 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Title Low‑Privileged Network Attack Allows Takeover of Oracle Applications Manager
Weaknesses CWE-284

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle applications Manager
CPEs cpe:2.3:a:oracle:applications_manager:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle applications Manager
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Applications Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-17T13:00:25.968Z

Reserved: 2026-08-31T15:40:57.353Z

Link: CVE-2026-83338

cve-icon Vulnrichment

Updated: 2026-09-17T12:59:30.391Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:47.133

Modified: 2026-09-17T14:17:42.390

Link: CVE-2026-83338

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T07:45:16Z

Weaknesses
  • CWE-269

    Improper Privilege Management