{"id":"CVE-2026-83390","kind":"vulnerability","aliases":["CVE-2026-83390"],"related":[],"title":"Oracle E-Business Suite: Applications Manager Diagnostics flaw leaks data, partial DoS","description":"Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Applications Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Applications Manager. CVSS 3.1 Base Score 4.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L).","summary":"Oracle Applications Manager, part of Oracle E-Business Suite, has a flaw in its Diagnostics component that lets a low-privileged user reach it over HTTP. A successful attack can read a subset of the data Applications Manager can access and partly disrupt the service.","severity":"medium","cvss":4.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oracle-applications-manager","oracle-ebs","self-hosted","vendor"],"not_affected_if":["default-config"],"how_to_check":"- Confirm the E-Business Suite release in use; the sources list affected versions as `12.2.3` through `12.2.15`.\n- Check whether Oracle Applications Manager Diagnostics is reachable over HTTP from untrusted networks.","fix":"- Apply the Oracle Critical Patch Update that addresses CVE-2026-83390 for your E-Business Suite release (patch number unknown from the sources).\n- Until patched, restrict network access to Oracle Applications Manager.","status":"open","published_at":"2026-10-20T22:19:55+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T04:41:36+00:00","updated_at":"2026-10-25T04:41:36+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T04:41:36Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update that addresses CVE-2026-83390 for your E-Business Suite release (patch number unknown from the sources).\n- Until patched, restrict network access to Oracle Applications Manager.","reach":"network","title":"Oracle E-Business Suite: Applications Manager Diagnostics flaw leaks data, partial DoS","impact":"low","summary":"Oracle Applications Manager, part of Oracle E-Business Suite, has a flaw in its Diagnostics component that lets a low-privileged user reach it over HTTP. A successful attack can read a subset of the data Applications Manager can access and partly disrupt the service.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","oracle-applications-manager","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Low-privileged user reads some app data and partially disrupts service.","analyst_note":"Find Oracle's Critical Patch Update advisory and patch number for CVE-2026-83390 to fill in the fix and the exact fixed version.","how_to_check":"- Confirm the E-Business Suite release in use; the sources list affected versions as `12.2.3` through `12.2.15`.\n- Check whether Oracle Applications Manager Diagnostics is reachable over HTTP from untrusted networks.","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with Oracle Applications Manager exposed to HTTP access. Teams on other releases or with Applications Manager reachable only from tightly controlled internal networks have lower exposure. The sources do not say which patch level is fixed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000674,"input_tokens":3500,"output_tokens":647,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-83390':16A,19A '/av':168C '12.2.15':100C '12.2.3':99C '3.1':156C,167C '4.2':159C 'abil':141C 'access':72B,111C,129C,137C 'affect':97C 'allow':105C 'applic':6A,22B,32B,69B,82C,117C,135C,153C 'attack':61B,108C,120C 'avail':162C 'base':157C 'busi':4A,39B,89C 'caus':143C 'compon':47B,91C 'compromis':115C 'confidenti':160C 'cve':14A,17A 'cvss':155C,164C,166C 'data':11A,68B,138C 'denial':146C 'diagnost':8A,46B,92C 'difficult':101C 'disrupt':75B 'dos':13A,150C 'e':3A,38B,88C 'e-busi':2A,37B,87C 'eb':26B 'exploit':103C 'flaw':9A,43B 'h/pr':170C 'host':29B 'http':58B,113C 'impact':163C 'l':176C 'l/i':174C 'l/ui':171C 'leak':10A 'let':49B 'low':52B,106C 'low-privileg':51B 'manag':7A,23B,33B,70B,83C,118C,136C,154C 'n/a':175C 'n/ac':169C 'n/s':172C 'network':110C 'oracl':1A,21B,25B,31B,36B,81C,86C,116C,134C,152C 'oracle-applications-manag':20B 'oracle-eb':24B 'part':34B,74B 'partial':12A,145C,149C 'privileg':53B,107C 'product':84C 'reach':55B 'read':63B,128C 'result':125C 'score':158C 'self':28B 'self-host':27B 'servic':77B,148C 'subset':65B,132C 'success':60B,119C 'suit':5A,40B,90C 'support':93C 'u/c':173C 'unauthor':127C,140C 'user':54B 'vector':165C 'vendor':30B 'version':94C 'via':112C 'vulner':78C,104C,123C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with Oracle Applications Manager exposed to HTTP access. Teams on other releases or with Applications Manager reachable only from tightly controlled internal networks have lower exposure. The sources do not say which patch level is fixed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:19:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-83390","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83390","severity":null,"published_at":"2026-10-20T22:19:55+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}