{"id":"CVE-2026-83392","kind":"vulnerability","aliases":["CVE-2026-83392"],"related":[],"title":"Oracle E-Business Suite: Applications Manager Diagnostics leaks some data to low-privilege users","description":"Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Applications Manager accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).","summary":"Oracle Applications Manager, part of E-Business Suite, has a flaw in its Diagnostics component that lets a low-privileged user read a subset of data over HTTP. The CVSS score is 3.1 (low), with only confidentiality impacted and exploitation rated difficult.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise-erp","oracle-ebs","self-hosted","vendor"],"not_affected_if":["diagnostics-not-exposed","unsupported-versions"],"how_to_check":"- Check the installed E-Business Suite release: `12.2.3` through `12.2.15` are listed as affected.\n- Confirm whether Oracle Applications Manager Diagnostics is reachable over HTTP from untrusted networks: unknown if the sources say more.","fix":"- Apply the Oracle Critical Patch Update fix for E-Business Suite 12.2.x: unknown, the sources do not name the patch.\n- Restrict access to Oracle Applications Manager Diagnostics pages to administrators on the internal network until patched.","status":"open","published_at":"2026-10-20T22:19:55+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T04:47:37+00:00","updated_at":"2026-10-25T04:47:37+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T04:47:37Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for E-Business Suite 12.2.x: unknown, the sources do not name the patch.\n- Restrict access to Oracle Applications Manager Diagnostics pages to administrators on the internal network until patched.","reach":"network","title":"Oracle E-Business Suite: Applications Manager Diagnostics leaks some data to low-privilege users","impact":"low","summary":"Oracle Applications Manager, part of E-Business Suite, has a flaw in its Diagnostics component that lets a low-privileged user read a subset of data over HTTP. The CVSS score is 3.1 (low), with only confidentiality impacted and exploitation rated difficult.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","self-hosted","enterprise-erp"],"confidence":0.7,"needs_auth":"yes","worst_case":"Low-privileged user reads a subset of Applications Manager data","analyst_note":"","how_to_check":"- Check the installed E-Business Suite release: `12.2.3` through `12.2.15` are listed as affected.\n- Confirm whether Oracle Applications Manager Diagnostics is reachable over HTTP from untrusted networks: unknown if the sources say more.","needs_analyst":false,"not_affected_if":["unsupported-versions","diagnostics-not-exposed"],"who_is_affected":"Teams running Oracle E-Business Suite 12.2.3 through 12.2.15 with Oracle Applications Manager available to users. The attacker needs a low-privileged account and network access over HTTP, and the impact is limited to reading some Applications Manager data. Organizations on other versions or without the Diagnostics component can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000663,"input_tokens":3459,"output_tokens":635,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':18A,21A '-83392':19A,22A '/av':149C '12.2.15':99C '12.2.3':98C '3.1':67B,139C,142C,148C 'access':110C,128C,136C 'affect':96C 'allow':104C 'applic':6A,34B,81C,116C,134C 'attack':107C,119C 'base':140C 'busi':4A,40B,88C 'compon':48B,90C 'compromis':114C 'confidenti':71B,143C 'cve':17A,20A 'cvss':64B,138C,145C,147C 'data':11A,60B,137C 'diagnost':8A,47B,91C 'difficult':76B,100C 'e':3A,39B,87C 'e-busi':2A,38B,86C 'eb':28B 'enterpris':24B 'enterprise-erp':23B 'erp':25B 'exploit':74B,102C 'flaw':44B 'h/pr':151C 'host':31B 'http':62B,112C 'impact':72B,144C 'l/i':155C 'l/ui':152C 'leak':9A 'let':50B 'low':14A,53B,68B,105C 'low-privileg':13A,52B 'manag':7A,35B,82C,117C,135C 'n':157C 'n/a':156C 'n/ac':150C 'n/s':153C 'network':109C 'oracl':1A,27B,33B,80C,85C,115C,133C 'oracle-eb':26B 'part':36B 'privileg':15A,54B,106C 'product':83C 'rate':75B 'read':56B,127C 'result':124C 'score':65B,141C 'self':30B 'self-host':29B 'subset':58B,131C 'success':118C 'suit':5A,41B,89C 'support':92C 'u/c':154C 'unauthor':126C 'user':16A,55B 'vector':146C 'vendor':32B 'version':93C 'via':111C 'vulner':77C,103C,122C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle E-Business Suite 12.2.3 through 12.2.15 with Oracle Applications Manager available to users. The attacker needs a low-privileged account and network access over HTTP, and the impact is limited to reading some Applications Manager data. Organizations on other versions or without the Diagnostics component can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:19:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-83392","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83392","severity":null,"published_at":"2026-10-20T22:19:55+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}