CVE-2022-21500: Oracle E-Business Suite Manage Proxies unauthenticated data access

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 7.5 with a network, no-privilege, no-interaction vector and a very high EPSS score, though no confirmed in-the-wild exploitation is documented.

What it is

Oracle E-Business Suite 12.2 contains a flaw in the Manage Proxies component that allows an attacker to reach critical data without prior authentication. The record gives no root-cause detail (CWE is listed as insufficient information), so the exact mechanism is unknown. Because the affected component governs proxy configuration, exposure of that data can be significant to the application's security posture.

Impact

An attacker can read critical data or all data accessible through Oracle E-Business Suite, a confidentiality-only impact with no integrity or availability effect. The CVSS vector rates confidentiality as high.

Attack surface

Reachable over the network via HTTP with no user interaction and no privileges required per the CVSS vector. The description notes authentication is required for a successful attack but that the user may be self-registered, so a self-service account may be enough to reach the vulnerable component.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is very high at roughly 0.72 (99th percentile), indicating elevated predicted exploitation activity. No ransomware association is documented.

What to do

• Apply the Oracle CPU July 2022 patch referenced in the advisory and patch availability document.
• Restrict network access to the E-Business Suite HTTP interface to trusted networks or VPN.
• Disable or tightly control self-registration so unauthenticated users cannot obtain accounts.
• Review and lock down Manage Proxies configuration and proxy-related privileges.
• Monitor for anomalous access to proxy configuration endpoints.

Detection

• Alert on HTTP requests to Manage Proxies endpoints from unauthenticated or newly self-registered sessions.
• Baseline normal access to proxy configuration pages and flag deviations by source IP and account age.
• Correlate E-Business Suite audit logs for proxy configuration reads with account creation events.
• Watch for scanning or enumeration of EBS HTTP paths preceding access to the Manage Proxies component.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.