Description
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Applications Manager accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 3.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Information Disclosure
Action: Assess Impact
AI Analysis

Impact

This vulnerability exists in the Diagnostics component of Oracle Applications Manager within Oracle E‑Business Suite. An attacker who is able to reach the system over HTTP and possesses only low privileges can exploit the flaw to read a subset of data that is otherwise accessible through the manager. The vulnerability permits read‑only access to confidential information, thereby compromising confidentiality.

Affected Systems

Oracle Applications Manager supported by Oracle E‑Business Suite versions 12.2.3 through 12.2.15 are impacted. No other versions are listed as vulnerable.

Risk and Exploitability

The CVSS Base Score of 3.1 indicates a low severity impact, primarily limited to confidentiality. An EPSS score is not reported, and the vulnerability is not listed in CISA KEV, suggesting it is not widely exploited. Attackers would need network access via HTTP and only low privileges; once connected, they can trigger the vulnerability to read protected data. Because the attack requires minimal skill and does not lead to privilege escalation or system compromise, the overall risk is considered low but still significant for data confidentiality.

Generated by OpenCVE AI on October 21, 2026 at 06:44 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor’s patch or upgrade Oracle Applications Manager to a version in which this flaw has been addressed, as noted in the Oracle security alert.
  • Disable or restrict HTTP access to the Diagnostics component, ensuring that only trusted, authenticated users can reach it.
  • Configure network segmentation or firewall rules to block unauthenticated or unauthorized HTTP traffic from reaching the Applications Manager server.

Generated by OpenCVE AI on October 21, 2026 at 06:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 07:00:00 +0000

Type Values Removed Values Added
Title Information Disclosure in Oracle Applications Manager Diagnostics
Weaknesses CWE-200
CWE-285

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Applications Manager accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle applications Manager
CPEs cpe:2.3:a:oracle:applications_manager:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle applications Manager
References
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Applications Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T14:11:45.641Z

Reserved: 2026-08-31T15:40:57.356Z

Link: CVE-2026-83392

cve-icon Vulnrichment

Updated: 2026-10-27T14:11:16.626Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:19:55.640

Modified: 2026-10-27T14:17:04.140

Link: CVE-2026-83392

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T18:30:09Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-285

    Improper Authorization