{"id":"CVE-2026-101500","kind":"vulnerability","aliases":["CVE-2026-101500"],"related":[],"title":"Oracle OPatchAuto: local high-privilege attacker can take over the tool","description":"Vulnerability in the Oracle Global Lifecycle Management OPatchAuto product of Oracle Global Lifecycle Management (component: Database extensions).  Supported versions that are affected are 12.2.0.1.16-12.2.0.1.52. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Global Lifecycle Management OPatchAuto executes to compromise Oracle Global Lifecycle Management OPatchAuto.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Global Lifecycle Management OPatchAuto. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H).","summary":"Oracle OPatchAuto, the patching tool in Oracle Global Lifecycle Management, has a flaw in its Database extensions component. An attacker who already has high privileges and logon to the host where OPatchAuto runs can take over the product, and a second person must take an action for the attack to succeed.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database-admins","opatchauto","oracle","oracle-database","vendor"],"not_affected_if":["no-shared-admin-logons","opatchauto-not-installed"],"how_to_check":"- Check the installed OPatchAuto version against the affected range `12.2.0.1.16` to `12.2.0.1.52` (unknown how to read the version from the sources)\n- Confirm whether OPatchAuto is installed on hosts where Oracle Database is patched (unknown exact path from the sources)","fix":"- Apply the Oracle Critical Patch Update fix for OPatchAuto; the fixed version is unknown from the sources\n- Check the Oracle security advisory for the patched release (unknown from the sources)","status":"open","published_at":"2026-10-20T22:17:59+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:55:24+00:00","updated_at":"2026-10-25T03:55:24+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:55:24Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for OPatchAuto; the fixed version is unknown from the sources\n- Check the Oracle security advisory for the patched release (unknown from the sources)","reach":"local","title":"Oracle OPatchAuto: local high-privilege attacker can take over the tool","impact":"high","summary":"Oracle OPatchAuto, the patching tool in Oracle Global Lifecycle Management, has a flaw in its Database extensions component. An attacker who already has high privileges and logon to the host where OPatchAuto runs can take over the product, and a second person must take an action for the attack to succeed.","category":"vendor","nicknames":[],"who_cares":["oracle","oracle-database","database-admins","opatchauto"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over OPatchAuto on the host","analyst_note":"Find the fixed OPatchAuto version and Oracle advisory link for CVE-2026-101500 in the Oracle Critical Patch Update notes; the NVD entry gave no fix.","how_to_check":"- Check the installed OPatchAuto version against the affected range `12.2.0.1.16` to `12.2.0.1.52` (unknown how to read the version from the sources)\n- Confirm whether OPatchAuto is installed on hosts where Oracle Database is patched (unknown exact path from the sources)","needs_analyst":true,"not_affected_if":["opatchauto-not-installed","no-shared-admin-logons"],"who_is_affected":"Teams that run Oracle Global Lifecycle Management OPatchAuto `12.2.0.1.16` through `12.2.0.1.52` on hosts where an admin logs on to patch Oracle databases. The attacker must already hold high privileges on that host, so systems without OPatchAuto or with no shared admin logons face little added risk.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.0007,"input_tokens":3550,"output_tokens":689,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101500':15A,18A '-2026':14A,17A '/av':171C '12.2.0.1.16':102C '12.2.0.1.52':103C '3.1':158C,170C '6.5':161C 'action':73B 'admin':21B 'affect':100C 'allow':107C 'alreadi':49B 'attack':7A,47B,76B,110C,131C,141C,143C 'avail':165C 'base':159C 'compon':45B,93C 'compromis':124C 'confidenti':162C 'cve':13A,16A 'cvss':157C,167C,169C 'databas':20B,26B,43B,94C 'database-admin':19B 'easili':104C 'execut':122C 'exploit':105C 'extens':44B,95C 'flaw':40B 'global':35B,83C,90C,118C,126C,153C 'h':179C 'h/a':178C 'h/i':177C 'h/ui':174C 'high':5A,51B,108C 'high-privileg':4A 'host':57B 'human':133C 'impact':166C 'infrastructur':115C 'integr':163C 'interact':134C 'l/ac':172C 'l/pr':173C 'lifecycl':36B,84C,91C,119C,127C,154C 'local':3A 'logon':54B,112C 'manag':37B,85C,92C,120C,128C,155C 'must':70B 'opatchauto':2A,22B,29B,59B,86C,121C,129C,156C 'oracl':1A,23B,25B,28B,34B,82C,89C,117C,125C,152C 'oracle-databas':24B 'patch':31B 'person':69B,137C 'privileg':6A,52B,109C 'product':65B,87C 'r/s':175C 'requir':132C 'result':148C 'run':60B 'score':160C 'second':68B 'succeed':78B 'success':130C,142C 'support':96C 'take':9A,62B,71B 'takeov':150C 'tool':12A,32B 'u/c':176C 'vector':168C 'vendor':27B 'version':97C 'vulner':79C,106C,146C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Oracle Global Lifecycle Management OPatchAuto `12.2.0.1.16` through `12.2.0.1.52` on hosts where an admin logs on to patch Oracle databases. The attacker must already hold high privileges on that host, so systems without OPatchAuto or with no shared admin logons face little added risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101500","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101500","severity":null,"published_at":"2026-10-20T22:17:59+00:00","modified_at":"2026-10-23T12:18:05+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}