Live › vulnerability › CVE-2026-101500
Go to dashboardOracle OPatchAuto, the patching tool in Oracle Global Lifecycle Management, has a flaw in its Database extensions component. An attacker who already has high privileges and logon to the host where OPatchAuto runs can take over the product, and a second person must take an action for the attack to succeed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run Oracle Global Lifecycle Management OPatchAuto 12.2.0.1.16 through on hosts where an admin logs on to patch Oracle databases. The attacker must already hold high privileges on that host, so systems without OPatchAuto or with no shared admin logons face little added risk.
12.2.0.1.52No product ranges from the sources yet.
12.2.0.1.16 to 12.2.0.1.52 (unknown how to read the version from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Oracle Global Lifecycle Management OPatchAuto product of Oracle Global Lifecycle Management (component: Database extensions). Supported versions that are affected are 12.2.0.1.16-12.2.0.1.52. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Global Lifecycle Management OPatchAuto executes to compromise Oracle Global Lifecycle Management OPatchAuto. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Global Lifecycle Management OPatchAuto. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H).
This page as .md · .json · in your agent: get_signal("CVE-2026-101500")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.