{"id":"CVE-2026-83382","kind":"vulnerability","aliases":["CVE-2026-83382"],"related":[],"title":"Oracle E-Business Suite: Report Manager flaw lets low-privilege users read some data","description":"Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Report Manager.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Report Manager accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","summary":"Oracle E-Business Suite's Report Manager component, under Internal Operations, has a flaw that lets an attacker with a low-privilege account read a subset of the data it can access. The sources rate it CVSS 4.3 with confidentiality impact only, reachable over the network via HTTPS.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erp","oracle-ebusiness-suite","self-hosted","vendor"],"not_affected_if":["unknown"],"how_to_check":"- Confirm the installed Oracle E-Business Suite release is within 12.2.3 to 12.2.15 (`unknown` for the exact check command; the sources do not give one)\n- Check Oracle's Critical Patch Update advisory for the patch that covers this CVE; the sources do not name it","fix":"- Apply the Oracle Critical Patch Update that addresses CVE-2026-83382 for Oracle E-Business Suite 12.2.x (patch number unknown from the sources)","status":"open","published_at":"2026-10-20T22:19:54+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T04:39:08+00:00","updated_at":"2026-10-25T04:39:08+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:39:08Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update that addresses CVE-2026-83382 for Oracle E-Business Suite 12.2.x (patch number unknown from the sources)","reach":"network","title":"Oracle E-Business Suite: Report Manager flaw lets low-privilege users read some data","impact":"low","summary":"Oracle E-Business Suite's Report Manager component, under Internal Operations, has a flaw that lets an attacker with a low-privilege account read a subset of the data it can access. The sources rate it CVSS 4.3 with confidentiality impact only, reachable over the network via HTTPS.","category":"vendor","nicknames":[],"who_cares":["oracle-ebusiness-suite","erp","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads a subset of Report Manager data","analyst_note":"Find Oracle's CPU advisory for CVE-2026-83382 at https://nvd.nist.gov/vuln/detail/CVE-2026-83382 and confirm the patch and any configuration conditions.","how_to_check":"- Confirm the installed Oracle E-Business Suite release is within 12.2.3 to 12.2.15 (`unknown` for the exact check command; the sources do not give one)\n- Check Oracle's Critical Patch Update advisory for the patch that covers this CVE; the sources do not name it","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with Report Manager reachable by users over HTTPS. The sources do not say which configurations expose the component beyond that, so the exposure of any given deployment is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000666,"input_tokens":3456,"output_tokens":641,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':18A,21A '-83382':19A,22A '/av':154C '12.2.15':105C '12.2.3':104C '3.1':144C,153C '4.3':71B,147C 'access':65B,115C,133C,141C 'account':56B 'affect':102C 'allow':109C 'attack':50B,112C,124C 'base':145C 'busi':4A,35B,93C 'compon':40B,95C 'compromis':119C 'confidenti':73B,148C 'cve':17A,20A 'cvss':70B,143C,150C,152C 'data':16A,62B,142C 'e':3A,34B,92C 'e-busi':2A,33B,91C 'easili':106C 'ebusi':26B 'erp':23B 'exploit':107C 'flaw':8A,46B 'host':30B 'https':81B,117C 'impact':74B,149C 'intern':42B,96C 'l/i':160C 'l/pr':156C 'l/ui':157C 'let':9A,48B 'low':11A,54B,110C 'low-privileg':10A,53B 'manag':7A,39B,87C,122C,140C 'n':162C 'n/a':161C 'n/ac':155C 'n/s':158C 'network':79B,114C 'oper':43B,97C 'oracl':1A,25B,32B,85C,90C,120C,138C 'oracle-ebusiness-suit':24B 'privileg':12A,55B,111C 'product':88C 'rate':68B 'reachabl':76B 'read':14A,57B,132C 'report':6A,38B,86C,121C,139C 'result':129C 'score':146C 'self':29B 'self-host':28B 'sourc':67B 'subset':59B,136C 'success':123C 'suit':5A,27B,36B,94C 'support':98C 'u/c':159C 'unauthor':131C 'user':13A 'vector':151C 'vendor':31B 'version':99C 'via':80B,116C 'vulner':82C,108C,127C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with Report Manager reachable by users over HTTPS. The sources do not say which configurations expose the component beyond that, so the exposure of any given deployment is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:19:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-83382","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83382","severity":null,"published_at":"2026-10-20T22:19:54+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}