Description
Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Report Manager. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Report Manager accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Read Access
Action: Patch Now
AI Analysis

Impact

Oracle Report Manager for Oracle E‑Business Suite, versions 12.2.3–12.2.15, contains an access control weakness that lets a low‑privileged attacker with HTTPS network access read data that should not be available. The flaw requires only a basic user account and does not alter service availability or integrity; the only effect is a confidentiality breach where sensitive report information can be retrieved by unauthorized users.

Affected Systems

Oracle Corporation’s Oracle Report Manager component of Oracle E‑Business Suite, specifically versions 12.2.3 through 12.2.15.

Risk and Exploitability

The CVSS 3.1 base score of 4.3 classifies the vulnerability as low to moderate severity. Exploitation requires network connectivity over HTTPS and possession of a low‑privileged account, making the attack vector realistic for internal adversaries or attackers who have compromised a legitimate user. EPSS data is not available and the flaw is not listed in CISA’s KEV catalog, indicating no known widespread exploitation, yet the vulnerability is documented in Oracle’s October 2026 CPU and a public fix has been released.

Generated by OpenCVE AI on October 21, 2026 at 06:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle October 2026 CPU security patch to all affected Report Manager installations
  • Restrict HTTPS traffic to the Report Manager to known, trusted hosts via firewall rules or VPN
  • Reduce user privileges for accounts that access Report Manager and enforce strict role‑based access controls
  • Monitor access logs for anomalous read patterns and investigate unauthorized data retrieval attempts

Generated by OpenCVE AI on October 21, 2026 at 06:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 07:15:00 +0000

Type Values Removed Values Added
Title Low‑Privilege Read Access via HTTPS in Oracle Report Manager
Weaknesses CWE-200
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Report Manager. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Report Manager accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle report Manager
CPEs cpe:2.3:a:oracle:report_manager:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle report Manager
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Report Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T13:42:23.287Z

Reserved: 2026-08-31T15:40:57.356Z

Link: CVE-2026-83382

cve-icon Vulnrichment

Updated: 2026-10-27T13:42:07.895Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:19:54.517

Modified: 2026-10-27T14:17:03.013

Link: CVE-2026-83382

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T21:45:06Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control