cve-2026-101742

HIGH CVSS 8.8 opencve
Description

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Timeline
Published
2026-10-20 22:18 UTC
Last Modified
2026-11-05
CVSS Details

CVSS details not available.

Affected Products

No product information available.

Weaknesses (CWE)
CWE-284
CVSS metrics
Version Base Severity Vector Exploitability Impact Source
3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H mitre
3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H nvd
3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H opencve
References

No references available.

Linked Vulnerabilities
cpuoct2026csaf csaf_oracle 

{
  "cve": "CVE-2026-101742",
  "enrichment": {
    "affected": [
      {
        "configurations": [
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "semver",
              "value": "[12.2.3,12.2.15]"
            }
          }
        ],
        "enrichment": {
          "confidence": 100.0,
          "confidence_source": "matching",
          "scores": [
            {
              "score": 100.0,
              "source": "matching"
            }
          ]
        },
        "original": {
          "product": "Oracle Applications Manager",
          "source": "cna",
          "vendor": "Oracle Corporation"
        },
        "product": "applications_manager",
        "vendor": "oracle"
      }
    ],
    "created": "2026-10-21T02:00:11.847525+00:00",
    "title": "Oracle Applications Manager Diagnostic Component Vulnerability Allows Remote Takeover",
    "updated": "2026-10-22T17:45:08.935619+00:00",
    "vendors": [
      "oracle",
      "oracle$PRODUCT$applications_manager"
    ],
    "weaknesses": [
      "CWE-284"
    ]
  },
  "epss": {
    "score": 0.00448
  },
  "mitre": {
    "cpes": [
      "cpe:2.3:a:oracle:applications_manager:*:*:*:*:*:*:*:*"
    ],
    "created": "2026-10-20T21:22:38.500000+00:00",
    "description": "Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 8.8,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
      },
      "cvssV4_0": {}
    },
    "mitre_repo_path": "cves/2026/101xxx/CVE-2026-101742.json",
    "references": [
      "https://www.oracle.com/security-alerts/cpuoct2026.html"
    ],
    "title": null,
    "updated": "2026-10-22T15:18:16.346000+00:00",
    "vendors": [
      "oracle",
      "oracle$PRODUCT$applications_manager"
    ],
    "weaknesses": []
  },
  "nvd": {
    "cpes": [
      "cpe:2.3:a:oracle:applications_manager:*:*:*:*:*:*:*:*"
    ],
    "created": "2026-10-20T22:18:29.200000+00:00",
    "description": "Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 8.8,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
      },
      "cvssV4_0": {}
    },
    "nvd_repo_path": "2026/CVE-2026-101742.json",
    "references": [
      "https://www.oracle.com/security-alerts/cpuoct2026.html"
    ],
    "title": null,
    "updated": "2026-11-05T13:24:16.203000+00:00",
    "vendors": [
      "oracle",
      "oracle$PRODUCT$applications_manager"
    ],
    "weaknesses": [
      "CWE-284"
    ]
  },
  "opencve": {
    "changes": [
      {
        "created": "2026-10-20T21:30:00+00:00",
        "data": [
          {
            "details": {
              "new": "Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",
              "old": null
            },
            "type": "description"
          },
          {
            "details": [
              "oracle",
              "oracle$PRODUCT$applications_manager"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "cpe:2.3:a:oracle:applications_manager:*:*:*:*:*:*:*:*"
              ],
              "removed": []
            },
            "type": "cpes"
          },
          {
            "details": {
              "added": [
                "oracle",
                "oracle$PRODUCT$applications_manager"
              ],
              "removed": []
            },
            "type": "vendors"
          },
          {
            "details": {
              "added": [
                "https://www.oracle.com/security-alerts/cpuoct2026.html"
              ],
              "removed": []
            },
            "type": "references"
          },
          {
            "details": {
              "added": {
                "cvssV3_1": {
                  "score": 8.8,
                  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "84b01375-ec35-4555-bcc8-43cd7aa04937"
      },
      {
        "created": "2026-10-21T02:15:00+00:00",
        "data": [
          {
            "details": {
              "new": "Oracle Applications Manager Diagnostic Component Vulnerability Allows Remote Takeover",
              "old": null
            },
            "type": "title"
          },
          {
            "details": {
              "added": [
                "CWE-284"
              ],
              "removed": []
            },
            "type": "weaknesses"
          }
        ],
        "id": "4f095582-7462-4449-aaff-9bad86c5c5b8"
      }
    ],
    "cpes": {
      "data": [
        "cpe:2.3:a:oracle:applications_manager:*:*:*:*:*:*:*:*"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    },
    "created": {
      "data": "2026-10-20T21:22:38.500000+00:00",
      "provider": "mitre"
    },
    "description": {
      "data": "Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",
      "provider": "mitre"
    },
    "metrics": {
      "cvssV2_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_1": {
        "data": {
          "score": 8.8,
          "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        },
        "provider": "mitre"
      },
      "cvssV4_0": {
        "data": {},
        "provider": null
      },
      "epss": {
        "data": {
          "score": 0.00448
        },
        "provider": "first"
      },
      "kev": {
        "data": {},
        "provider": null
      },
      "ssvc": {
        "data": {},
        "provider": null
      },
      "threat_severity": {
        "data": null,
        "provider": null
      }
    },
    "references": {
      "data": [
        "https://www.oracle.com/security-alerts/cpuoct2026.html"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    },
    "title": {
      "data": "Oracle Applications Manager Diagnostic Component Vulnerability Allows Remote Takeover",
      "provider": "enrichment"
    },
    "updated": {
      "data": "2026-10-21T02:00:11.847533+00:00",
      "provider": "enrichment"
    },
    "vendors": {
      "data": [
        "oracle",
        "oracle$PRODUCT$applications_manager"
      ],
      "providers": [
        "mitre",
        "nvd",
        "enrichment"
      ]
    },
    "weaknesses": {
      "data": [
        "CWE-284"
      ],
      "providers": [
        "nvd",
        "enrichment"
      ]
    }
  }
}
View JSON API Download JSON