{"cve":"CVE-2026-83341","enrichment":{"affected":[{"configurations":[{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[12.2.3,12.2.15]"}}],"enrichment":{"confidence":95.0,"confidence_source":"inferred","scores":[{"score":95.0,"source":"inferred"},{"score":100.0,"source":"matching"}]},"original":{"product":"Oracle Applications Manager","source":"cna","vendor":"Oracle Corporation"},"product":"applications_manager","vendor":"oracle"}],"created":"2026-09-16T12:00:17.893963+00:00","title":"Unauthenticated HTTP Access Exposes Sensitive Data in Oracle Applications Manager","updated":"2026-09-20T07:45:16.279783+00:00","vendors":["oracle","oracle$PRODUCT$applications_manager"],"weaknesses":["CWE-284"]},"epss":{"score":0.00394},"mitre":{"cpes":["cpe:2.3:a:oracle:applications_manager:*:*:*:*:*:*:*:*"],"created":"2026-09-15T20:05:21.174000+00:00","description":"Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/83xxx/CVE-2026-83341.json","references":["https://www.oracle.com/security-alerts/cspusep2026.html"],"title":null,"updated":"2026-09-21T19:08:00.219000+00:00","vendors":["oracle","oracle$PRODUCT$applications_manager"],"weaknesses":[]},"nvd":{"cpes":[],"created":"2026-09-15T20:18:47.470000+00:00","description":"Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-83341.json","references":["https://www.oracle.com/security-alerts/cspusep2026.html"],"title":null,"updated":"2026-09-21T20:17:34.617000+00:00","vendors":[],"weaknesses":["CWE-284"]},"opencve":{"changes":[{"created":"2026-09-15T20:15:00+00:00","data":[{"details":{"new":"Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","old":null},"type":"description"},{"details":["oracle","oracle$PRODUCT$applications_manager"],"type":"first_time"},{"details":{"added":["cpe:2.3:a:oracle:applications_manager:*:*:*:*:*:*:*:*"],"removed":[]},"type":"cpes"},{"details":{"added":["oracle","oracle$PRODUCT$applications_manager"],"removed":[]},"type":"vendors"},{"details":{"added":["https://www.oracle.com/security-alerts/cspusep2026.html"],"removed":[]},"type":"references"},{"details":{"added":{"cvssV3_1":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"fae4bf0b-5d7c-4220-83ac-fb13463bb5de"},{"created":"2026-09-17T02:45:00+00:00","data":[{"details":{"new":"Unauthenticated Remote Data Access via Command Line RapidClone in Oracle Applications Manager","old":null},"type":"title"},{"details":{"added":["CWE-200"],"removed":[]},"type":"weaknesses"}],"id":"a4e4d6db-c235-4bc4-a125-7941bfe2a0c6"},{"created":"2026-09-18T21:30:00+00:00","data":[{"details":{"new":null,"old":"Unauthenticated Remote Data Access via Command Line RapidClone in Oracle Applications Manager"},"type":"title"},{"details":{"added":[],"removed":["CWE-200"]},"type":"weaknesses"}],"id":"b7010374-3e0c-4ff4-b161-650c1376e8c1"},{"created":"2026-09-20T08:00:00+00:00","data":[{"details":{"new":"Unauthenticated HTTP Access Exposes Sensitive Data in Oracle Applications Manager","old":null},"type":"title"},{"details":{"added":["CWE-284"],"removed":[]},"type":"weaknesses"}],"id":"56cbb472-9dad-4c69-952e-25ec10a243e0"},{"created":"2026-09-21T20:30:00+00:00","data":[{"details":{"added":{"ssvc":{"options":{"Automatable":"yes","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"d2486675-3d04-4177-b290-4d7b3692b1cc"}],"cpes":{"data":["cpe:2.3:a:oracle:applications_manager:*:*:*:*:*:*:*:*"],"providers":["mitre"]},"created":{"data":"2026-09-15T20:05:21.174000+00:00","provider":"mitre"},"description":{"data":"Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"provider":"mitre"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.00394},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{"options":{"Automatable":"yes","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://www.oracle.com/security-alerts/cspusep2026.html"],"providers":["mitre","nvd"]},"title":{"data":"Unauthenticated HTTP Access Exposes Sensitive Data in Oracle Applications Manager","provider":"enrichment"},"updated":{"data":"2026-09-21T20:17:34.617000+00:00","provider":"nvd"},"vendors":{"data":["oracle","oracle$PRODUCT$applications_manager"],"providers":["mitre","enrichment"]},"weaknesses":{"data":["CWE-284"],"providers":["nvd","vulnrichment","enrichment"]}},"vulnrichment":{"cpes":[],"created":"2026-09-15T20:05:21.174000+00:00","description":"Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{},"kev":{},"ssvc":{"options":{"Automatable":"yes","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"}},"references":[],"title":null,"updated":"2026-09-21T19:07:55.869000+00:00","vendors":[],"vulnrichment_repo_path":"2026/83xxx/CVE-2026-83341.json","weaknesses":["CWE-284"]}}