Oracle Applications Manager: Vulnerability allowing takeover over HTTP
Summary
Oracle Applications Manager, part of Oracle E-Business Suite, contains a vulnerability that a low-privileged attacker with network access via HTTP can use to compromise the product. Successful exploitation could lead to a takeover of Oracle Applications Manager. NVD rates it CVSS 3.1 8.8, but Oracle's risk matrix and other sources disagree on the score and weakness type, so the rating still needs confirmation.
Affected
- Oracle Applications Manager 12.2.3 through 12.2.15 (as stated in the NVD record and the Oracle description)
Fixed in
- Fix via the Oracle Critical Patch Update for October 2026 (released 20 October 2026)
- Exact patch number for Applications Manager: Unknown. Check My Oracle Support Note KA923 and Oracle's text-form risk matrices.
Workaround
- Unknown specific workaround for this CVE.
- General Oracle EBS guidance (reported by a third party): block the network protocols an attack needs and remove unneeded user privileges. Oracle does not consider these a long-term solution.
- Keep E-Business Suite and middleware consoles off the public internet.
Exploitation
- No exploitation reported.
- CISA SSVC data lists exploitation as none and automatable as no. The CVE is not in CISA KEV.
- No public proof-of-concept found in limited searches; this does not prove its absence.
Our recommendation
- If you run E-Business Suite 12.2.3 to 12.2.15, treat this as high priority.
- Apply the October 2026 CPU patches for Applications Manager using MOS Note KA923.
- Remove Applications Manager and EBS administration interfaces from public internet access.
- Review accounts with access to the EBS system and remove unnecessary low-privilege access.
- Monitor HTTP access to the management interfaces for unusual activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory October 2026 www.oracle.com
- Oracle Critical Patch Update Advisory October 2026 (text-form risk matrices) www.oracle.com
- Oracle E-Business Suite blog: October 2026 CPU now available blogs.oracle.com
- VulDB entry for CVE-2026-91532 vuldb.com
- VulDB vulnerability 424358 vuldb.com
- OpenCVE entry for CVE-2026-91532 app.opencve.io
- Vulners entry for CVE-2026-91532 vulners.com
- CNNVD-2026-81533017 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:25.
Original description (NVD)
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.