---
id: "CVE-2026-91532"
kind: "vulnerability"
aliases: ["CVE-2026-91532"]
title: "Oracle E-Business Suite: Applications Manager flaw lets low-privilege users take over"
severity: "high"
cvss: 8.8
epss: 0.00447
exploited: false
status: "open"
category: "package"
products: [{"name": "Oracle E-Business Suite (Applications Manager)", "fixed": ["October 2026 CPU (patch 40022426, per Rapid7, unconfirmed)"], "affected": ">= 12.2.3, <= 12.2.15", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["oracle-applications-manager", "oracle-ebs", "package", "self-hosted"]
not_affected_if: ["default-config", "managed-hosting"]
published_at: "2026-10-20T22:20:56+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91532", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:53:05+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91532", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Oracle E-Business Suite: Applications Manager flaw lets low-privilege users take over

Oracle Applications Manager (EBS 12.2.3-12.2.15), Internal Operations component: a low-privileged user with network access over HTTP can take over Oracle Applications Manager. CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N). Fixed in the October 2026 Critical Patch Update. Oracle does not publish the exact HTTP path.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle E-Business Suite (Applications Manager) affected >= 12.2.3, <= 12.2.15 fixed October 2026 CPU (patch 40022426, per Rapid7, unconfirmed)

## How to check

Check whether you run Oracle E-Business Suite 12.2.3-12.2.15 with Oracle Applications Manager enabled. Then check whether the Oct 2026 CPU EBS patch is applied: query AD_BUGS for the patch number in the Oracle EBS patch availability document (Rapid7 cites 40022426). Restrict network access to the OAM HTTP endpoints until patched.

## Fix

Apply the Oracle Critical Patch Update of October 2026 for Oracle E-Business Suite (Rapid7 cites patch 40022426:12.2.0), applied with adop. Confirm the patch number in the EBS patch availability document on My Oracle Support.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91532
- 2026-10-23T23:53:05+00:00 analyst — Oracle CPU Oct 2026 (cve.org record) lists EBS 12.2.3-12.2.15 affected; Rapid7 names Patch 40022426:12.2.0, which I did not confirm on Oracle's MOS patch page (login needed). No exploitation or PoC found (not in KEV per Rapid7, Armis). No social search done.
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91532

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [advisory] CVE Record: CVE-2026-91532 https://www.cve.org/CVERecord?id=CVE-2026-91532
- [fix] Rapid7: Oracle E-Business Suite CVE-2026-91532 https://www.rapid7.com/db/vulnerabilities/cve-2026-91532/

## From the sources

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_