This vulnerability affects the Command Line - RapidClone component of Oracle Applications Manager in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker who has logon access to the underlying infrastructure to compromise Oracle Applications Manager. Exploitation can result in unauthorized creation, deletion, or modification of critical data or complete unauthorized access to all data accessible by Oracle Applications Manager. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, reflecting local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts.

The vulnerability allows attackers with low privileges and logon access to the infrastructure to gain unauthorized control over Oracle Applications Manager data. This includes the ability to create, delete, or modify critical data, or gain complete unauthorized access to all data accessible by Oracle Applications Manager. This compromises confidentiality and integrity of sensitive data managed by the application. There is no impact on availability.

Oracle has released security patches addressing this vulnerability as part of their September 2026 Critical Security Patch Update. Customers running affected versions (12.2.3 through 12.2.15) of Oracle Applications Manager should apply the relevant patches promptly to remediate this vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory. No alternative mitigations or workarounds are specified.