Executive brief
Oracle E-Business Suite Applications Manager is a system administration tool used to manage and deploy Oracle business applications across enterprises. A vulnerability in its RapidClone command-line component allows privileged attackers to execute unauthorized commands, potentially gaining full control over the application environment and impacting dependent systems and data integrity.
Technical details
The vulnerability exists in the Command Line component (RapidClone) of Oracle Applications Manager in E-Business Suite versions 12.2.3–12.2.15. It is a difficult-to-exploit flaw requiring high privilege level and network access via HTTP. While the primary target is Oracle Applications Manager, successful exploitation can impact additional products due to a scope change (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H). An authenticated high-privileged attacker can achieve complete compromise including confidentiality, integrity, and availability impacts. Patch availability via Oracle's standard security update schedule should be verified.
Affected products
- Oracle E-Business Suite 12.2.3–12.2.15
Timeline
- 2026-09-15: disclosed