CVE-2026-60322
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Vulnerability in Oracle Applications Manager component of Oracle E-Business Suite (Oracle Diagnostics Interfaces). Affects versions 12.2.3-12.2.15. An unauthenticated attacker with network access via HTTP can exploit it without user interaction. Successful attack allows unauthorized update, insert, or delete access to some data and read access to a subset of data.
Risk Assessment
The risk is remote unauthenticated access to application data, potentially compromising confidentiality and integrity.
Recommendation
Apply Oracle patches for versions 12.2.3-12.2.15 immediately and restrict HTTP access.
Other vulnerabilities in Oracle Applications Manager
See all- CVE-2026-46933Critical
A vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite allows a low privileged attacker with network access via HTTP to compromise Oracle Applications Manager. Attacks may significantly impact additional products.
- CVE-2026-83341High
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone). Affected versions are 12.2.3-12.2.15. An easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager, resulting in unauthorized access to critical data.
- CVE-2026-83338High
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces). Affected versions are 12.2.3-12.2.15. An easily exploitable vulnerability allows a low privileged attacker with network access via HTTP to compromise Oracle Applications Manager.
- CVE-2026-83168High
Vulnerability in Oracle Applications Manager (component: Oracle Diagnostics Interfaces) in versions 12.2.3-12.2.15. Easily exploitable, allows low-privileged attacker via HTTPS to take over the system.
- CVE-2026-83115High
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone). Affected supported versions are 12.2.3-12.2.15. An easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager, resulting in unauthorized access to critical data.
- CVE-2026-60763High
Vulnerability in Oracle Applications Manager (component: Command Line - RapidClone) versions 12.2.3-12.2.15. An unauthenticated attacker with local access can fully compromise the system.
- CVE-2025-53058Medium
Vulnerability in Oracle Applications Manager (Oracle E-Business Suite, Application Logging Interfaces component) versions 12.2.3-12.2.14. Easily exploitable, allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager. Requires user interaction, and attacks may impact additional products (scope change). Successful attacks can result in unauthorized update, insert or delete of some data and unauthorized read access to a subset of data. CVSS 6.1 (Confidentiality and Integrity).
Original NVD description (English source)
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Manager accessible data as well as unauthorized read access to a subset of Oracle Applications Manager accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS