Description
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote takeover of Oracle Applications Manager
Action: Apply Patch
AI Analysis

Impact

The vulnerability in the Oracle Applications Manager component of Oracle E‑Business Suite permits a low‑privileged attacker who can reach the HTTP endpoint to compromise the entire manager. The flaw, identified as insecure direct object reference (CWE‑306), can be triggered by objects accessed without proper authorization, leading to complete takeover of the application with confidentiality, integrity and availability loss. It carries a CVSS 3.1 Base Score of 8.8.

Affected Systems

Affected vendor and product are Oracle Corporation’s Oracle Applications Manager within the Oracle E‑Business Suite. Versions 12.2.3 through 12.2.15 are impacted, as listed by the CNA.

Risk and Exploitability

The CVSS score of 8.8 signals high severity. The attack vector is via the network on HTTP and requires only low privileges. The EPSS score is below 1%, indicating a very low current exploitation probability, yet the combination of low privilege requirement and absolute control over the manager suggests a serious risk. The vulnerability is not present in CISA’s KEV catalog, and no public exploits have been reported, but the profile of remote reachability and minimal privileges remains concerning for exposed installations.

Generated by OpenCVE AI on October 27, 2026 at 10:43 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle CPU Oct 2026 security patch for Oracle Applications Manager.
  • Restrict HTTP traffic to the manager to trusted hosts through firewall or network segmentation.
  • Secure authentication by eliminating default accounts or enforcing strong password policies to reduce low‑privilege risk.
  • Enable detailed logging for authentication and administrative activity, and monitor logs for suspicious events.

Generated by OpenCVE AI on October 27, 2026 at 10:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
Title Remote Takeover of Oracle Applications Manager via Low-Privilege HTTP Access

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Remote Takeover of Oracle Applications Manager
Weaknesses CWE-284
CWE-287

Mon, 26 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Remote Takeover of Oracle Applications Manager
Weaknesses CWE-284
CWE-287

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle applications Manager
CPEs cpe:2.3:a:oracle:applications_manager:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle applications Manager
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Applications Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-26T20:03:08.547Z

Reserved: 2026-09-14T22:10:16.642Z

Link: CVE-2026-91532

cve-icon Vulnrichment

Updated: 2026-10-26T20:03:04.082Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:56.950

Modified: 2026-11-04T21:01:00.410

Link: CVE-2026-91532

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T10:45:06Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function