Description
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Applications Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Applications Manager. CVSS 3.1 Base Score 4.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L).
Published: 2026-10-20
Score: 4.2 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Access and Partial Denial of Service
Action: Assess Impact
AI Analysis

Impact

The vulnerability resides in the Diagnostics component of Oracle Applications Manager. A low‑privileged attacker with network access via HTTP can exploit the flaw to read a subset of the Manager’s accessible data and trigger a partial denial of service. This weakness corresponds to information disclosure (CWE-200). The CVSS v3.1 Base Score of 4.2 reflects modest confidentiality and availability impact.

Affected Systems

Oracle Corporation’s Oracle Applications Manager, part of the Oracle E‑Business Suite, is affected. The Diagnostics component is vulnerable in supported versions from 12.2.3 through 12.2.15. These versions should be identified and examined for remediation.

Risk and Exploitability

The likely attack vector is HTTP over the network. A low‑ileged attacker can exploit the flaw, giving unauthorized read of a subset of data and triggering a partial denial of service. The CVSS v3.1 score of 4.2 indicates modest confidentiality and availability impact. The EPSS score of less than 1% shows a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, given that the flaw exposes confidential data and can disrupt operations, monitoring for related activity and ensuring network segmentation are prudent.

Generated by OpenCVE AI on October 28, 2026 at 01:18 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the patch or upgrade specified in Oracle’s 2026 Oct CPU advisory to fix the Diagnostics vulnerability.
  • Restrict inbound HTTP traffic to Oracle Applications Manager to trusted IP ranges or VPN to limit exposure to low‑privileged attackers.
  • Strengthen access controls on the Diagnostics component, ensuring only authorized users can read data and that service requests are rate‑limited to prevent partial denial of service.

Generated by OpenCVE AI on October 28, 2026 at 01:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 01:45:00 +0000

Type Values Removed Values Added
Title Low-Privilege Information Disclosure and Partial Denial of Service in Oracle Applications Manager Diagnostics

Tue, 27 Oct 2026 23:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Access and Partial Denial of Service via HTTP in Oracle Applications Manager Diagnostics
Weaknesses CWE-284

Tue, 27 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 07:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Access and Partial Denial of Service via HTTP in Oracle Applications Manager Diagnostics
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Applications Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Applications Manager. CVSS 3.1 Base Score 4.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L).
First Time appeared Oracle
Oracle applications Manager
CPEs cpe:2.3:a:oracle:applications_manager:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle applications Manager
References
Metrics cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L'}

Subscriptions

Oracle Applications Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T14:09:45.470Z

Reserved: 2026-08-31T15:40:57.356Z

Link: CVE-2026-83390

cve-icon Vulnrichment

Updated: 2026-10-27T14:09:41.110Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:19:55.417

Modified: 2026-10-27T14:17:03.920

Link: CVE-2026-83390

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T01:30:14Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor