CVE-2026-83125
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Vulnerability in the Oracle Report Manager product (Internal Operations component) of Oracle E-Business Suite, affecting versions 12.2.3-12.2.15. A low privileged authenticated attacker with network access via HTTP can take over Oracle Report Manager. The vulnerability is easily exploitable.
Risk Assessment
An attacker can take over Oracle Report Manager, leading to confidentiality, integrity, and availability breaches. This may result in full compromise of the reporting system.
Recommendation
Immediately apply the Oracle security updates for versions 12.2.3-12.2.15 and verify user privileges in Oracle Report Manager. Monitor for unusual activity in the Internal Operations component.
Other vulnerabilities in Oracle Report Manager
See all- CVE-2026-101642High
Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations) affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a low privileged attacker with network access via HTTPS to gain unauthorized access to critical data and cause a partial denial of service.
- CVE-2026-101641High
Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations) affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a low privileged attacker with network access via HTTPS to gain unauthorized access to critical data, update/insert/delete some data, and cause a partial denial of service.
- CVE-2026-87126High
Vulnerability in Oracle Report Manager within Oracle E-Business Suite (component: Reports Security) affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to compromise the system. It can lead to unauthorized access to critical data and partial denial of service (partial DoS).
- CVE-2026-83123High
Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations). Affected supported versions are 12.2.3-12.2.15. An easily exploitable vulnerability allows a low privileged attacker with network access via HTTPS to compromise Oracle Report Manager, resulting in unauthorized access to critical data and partial denial of service.
- CVE-2026-83122High
Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations). Affected supported versions are 12.2.3-12.2.15. An easily exploitable vulnerability allows a low privileged attacker with network access via HTTPS to compromise Oracle Report Manager.
Original NVD description (English source)
Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Report Manager. Successful attacks of this vulnerability can result in takeover of Oracle Report Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS

