CVE-2026-83125
HighCVSS 8.8Summary
Vulnerability in the Oracle Report Manager product (Internal Operations component) of Oracle E-Business Suite, affecting versions 12.2.3-12.2.15. A low privileged authenticated attacker with network access via HTTP can take over Oracle Report Manager. The vulnerability is easily exploitable.
Risk Assessment
An attacker can take over Oracle Report Manager, leading to confidentiality, integrity, and availability breaches. This may result in full compromise of the reporting system.
Recommendation
Immediately apply the Oracle security updates for versions 12.2.3-12.2.15 and verify user privileges in Oracle Report Manager. Monitor for unusual activity in the Internal Operations component.
Other vulnerabilities in Oracle Report Manager
See all- CVE-2026-87126High
Vulnerability in Oracle Report Manager within Oracle E-Business Suite (component: Reports Security) affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to compromise the system. It can lead to unauthorized access to critical data and partial denial of service (partial DoS).
- CVE-2026-83123High
Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations). Affected supported versions are 12.2.3-12.2.15. An easily exploitable vulnerability allows a low privileged attacker with network access via HTTPS to compromise Oracle Report Manager, resulting in unauthorized access to critical data and partial denial of service.
- CVE-2026-83122High
Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations). Affected supported versions are 12.2.3-12.2.15. An easily exploitable vulnerability allows a low privileged attacker with network access via HTTPS to compromise Oracle Report Manager.
Original NVD description (English source)
Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Report Manager. Successful attacks of this vulnerability can result in takeover of Oracle Report Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).