CVE-2026-83115

CVE-2026-83115 is an easily exploitable information disclosure vulnerability in the RapidClone command-line component of Oracle Applications Manager, part of Oracle E-Business Suite. An unauthenticated remote attacker with network access can trigger the flaw by sending crafted HTTP requests to the vulnerable Applications Manager/RapidClone functionality, with no user interaction or privileges required. Successful attacks result in unauthorized read access to critical data or complete access to all data reachable by Oracle Applications Manager; per the CVSS vector, the impact is confidentiality only (no integrity or availability impact). Affected deployments are Oracle E-Business Suite releases 12.2.3 through 12.2.15. There is no known public proof of concept and no evidence of in-the-wild exploitation, and the CVE is not on the CISA Known Exploited Vulnerabilities catalog.

What to do: Apply the Oracle Critical Patch Update that resolves this CVE and bring affected 12.2.3-12.2.15 environments up to the latest 12.2 patch level. Do not expose Oracle Applications Manager or RapidClone functionality to the public internet; restrict access to trusted networks or behind VPN/SSO. Review HTTP access logs for unauthenticated requests to Applications Manager/RapidClone endpoints and assess what sensitive data those endpoints could have disclosed.