{"id":"CVE-2026-91532","kind":"vulnerability","aliases":["CVE-2026-91532"],"related":[],"title":"Oracle E-Business Suite: Applications Manager flaw lets low-privilege users take over","description":"Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Applications Manager (EBS 12.2.3-12.2.15), Internal Operations component: a low-privileged user with network access over HTTP can take over Oracle Applications Manager. CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N). Fixed in the October 2026 Critical Patch Update. Oracle does not publish the exact HTTP path.","severity":"high","cvss":8.8,"epss":0.00447,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle E-Business Suite (Applications Manager)","fixed":["October 2026 CPU (patch 40022426, per Rapid7, unconfirmed)"],"affected":">= 12.2.3, <= 12.2.15","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["oracle-applications-manager","oracle-ebs","package","self-hosted"],"not_affected_if":["default-config","managed-hosting"],"how_to_check":"Check whether you run Oracle E-Business Suite 12.2.3-12.2.15 with Oracle Applications Manager enabled. Then check whether the Oct 2026 CPU EBS patch is applied: query AD_BUGS for the patch number in the Oracle EBS patch availability document (Rapid7 cites 40022426). Restrict network access to the OAM HTTP endpoints until patched.","fix":"Apply the Oracle Critical Patch Update of October 2026 for Oracle E-Business Suite (Rapid7 cites patch 40022426:12.2.0), applied with adop. Confirm the patch number in the EBS patch availability document on My Oracle Support.","status":"open","published_at":"2026-10-20T22:20:56+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-23T22:33:50+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:33:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle E-Business Suite: Applications Manager flaw lets low-privilege users take over","impact":"high","summary":"Oracle Applications Manager in E-Business Suite 12.2.3 through 12.2.15 has a flaw in its Internal Operations component. A low-privileged user with network access over HTTP can fully take over the product.","category":"package","who_cares":["oracle-ebs","oracle-applications-manager","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker takes over Applications Manager, reading and changing its data","analyst_note":"Check Oracle's Critical Patch Update advisory and the E-Business Suite patch list for the fixed patch level for 12.2.3-12.2.15 and the exact HTTP path affected.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000487,"input_tokens":3072,"output_tokens":359,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Oracle's Critical Patch Update advisory and the E-Business Suite patch list for the fixed patch level for 12.2.3-12.2.15 and the exact HTTP path affected.","search":"'-2026':16A,19A '-91532':17A,20A '/av':156C '12.2.15':44B,111C '12.2.3':43B,110C '2026':76B '3.1':65B,143C,155C '8.8':66B,146C 'access':55B,121C 'affect':108C 'allow':115C 'applic':6A,30B,40B,62B,92C,127C,140C 'applications':26A 'attack':118C,130C 'av':67B 'avail':150C 'base':144C 'busi':4A,99C 'business':24A 'compon':47B,101C 'compromis':125C 'confidenti':147C 'critic':77B 'cve':15A,18A 'cvss':64B,142C,152C,154C 'e':3A,23A,98C 'e-busi':2A,97C 'e-business':22A 'easili':112C 'eb':34B,42B 'exact':85B 'exploit':113C 'fix':72B 'flaw':8A 'h':164C 'h/a':163C 'h/i':162C 'host':38B 'http':57B,86B,123C 'impact':151C 'integr':148C 'intern':45B,102C 'l/pr':69B,158C 'l/ui':70B,159C 'let':9A 'low':11A,50B,116C 'low-privileg':10A,49B 'manag':7A,31B,41B,63B,93C,128C,141C 'manager':27A 'n':71B 'n/ac':68B,157C 'n/s':160C 'network':54B,120C 'octob':75B 'oper':46B,103C 'oracl':1A,29B,33B,39B,61B,80B,91C,96C,126C,139C 'oracle':21A 'oracle-applications-manag':28B 'oracle-eb':32B 'packag':35B 'patch':78B 'path':87B 'privileg':12A,51B,117C 'product':94C 'publish':83B 'result':135C 'score':145C 'self':37B 'self-host':36B 'success':129C 'suit':5A,100C 'suite':25A 'support':104C 'take':14A,59B 'takeov':137C 'u/c':161C 'updat':79B 'user':13A,52B 'vector':153C 'version':105C 'via':122C 'vulner':88C,114C,133C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91532","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91532","severity":null,"published_at":"2026-10-20T22:20:56+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91532:538","url":null,"severity":null,"published_at":"2026-10-23T23:53:05+00:00","modified_at":"2026-10-23T23:53:05+00:00","first_seen_at":"2026-10-23T23:53:05+00:00","fetched_at":"2026-10-23T23:53:05+00:00","note":"Oracle CPU Oct 2026 (cve.org record) lists EBS 12.2.3-12.2.15 affected; Rapid7 names Patch 40022426:12.2.0, which I did not confirm on Oracle's MOS patch page (login needed). No exploitation or PoC found (not in KEV per Rapid7, Armis). No social search done."},{"source":"epss","external_id":"CVE-2026-91532","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91532","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2214,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-91532/","title":"Rapid7: Oracle E-Business Suite CVE-2026-91532","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":2217,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91532","title":"CVE Record: CVE-2026-91532","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}