{"id":"CVE-2026-101535","kind":"vulnerability","aliases":["CVE-2026-101535"],"related":[],"title":"Oracle Sales Foundation: low-privileged network user can take over the product","description":"Vulnerability in the Oracle Sales Foundation product of Oracle E-Business Suite (component: Security API).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Foundation.  Successful attacks of this vulnerability can result in takeover of Oracle Sales Foundation. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Sales Foundation in E-Business Suite versions 12.2.3 through 12.2.15 has a flaw in its Security API that an attacker can reach over HTTP. A low-privileged account with network access could fully compromise the product, per the CVSS 7.5 score with high confidentiality, integrity and availability impact.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise-apps","oracle-ebs","oracle-sales-foundation","self-hosted","vendor"],"not_affected_if":["not-running-ebs","outside-affected-versions"],"how_to_check":"- Check the installed Oracle E-Business Suite release and whether Oracle Sales Foundation is in use, since the affected range is `12.2.3` through `12.2.15`\n- Review the Oracle Critical Patch Update advisory for the patch level that covers this CVE; the sources do not name the patch","fix":"- Apply the Oracle Critical Patch Update that addresses CVE-2026-101535 for Oracle Sales Foundation in E-Business Suite; the sources do not name the exact patch or fixed version\n- Move to a supported E-Business Suite release newer than `12.2.15` if the patch is not available for the current version","status":"open","published_at":"2026-10-20T22:18:02+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:20:28+00:00","updated_at":"2026-10-25T03:20:28+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T03:20:28Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update that addresses CVE-2026-101535 for Oracle Sales Foundation in E-Business Suite; the sources do not name the exact patch or fixed version\n- Move to a supported E-Business Suite release newer than `12.2.15` if the patch is not available for the current version","reach":"internet","title":"Oracle Sales Foundation: low-privileged network user can take over the product","impact":"high","summary":"Oracle Sales Foundation in E-Business Suite versions 12.2.3 through 12.2.15 has a flaw in its Security API that an attacker can reach over HTTP. A low-privileged account with network access could fully compromise the product, per the CVSS 7.5 score with high confidentiality, integrity and availability impact.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","oracle-sales-foundation","self-hosted","enterprise-apps"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker takes over Oracle Sales Foundation after low-privileged login","analyst_note":"Find the Oracle Critical Patch Update advisory and patch name for CVE-2026-101535 and confirm the fixed release, since the sources only give the NVD entry.","how_to_check":"- Check the installed Oracle E-Business Suite release and whether Oracle Sales Foundation is in use, since the affected range is `12.2.3` through `12.2.15`\n- Review the Oracle Critical Patch Update advisory for the patch level that covers this CVE; the sources do not name the patch","needs_analyst":true,"not_affected_if":["not-running-ebs","outside-affected-versions"],"who_is_affected":"Organizations running Oracle E-Business Suite 12.2 with the Oracle Sales Foundation component in the affected range `12.2.3` through `12.2.15`, reachable over HTTP. Teams not running Oracle E-Business Suite or Sales Foundation can skip it. The sources do not say whether specific configurations change exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000715,"input_tokens":3453,"output_tokens":740,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101535':16A,19A '-2026':15A,18A '/av':154C '12.2.15':45B,108C '12.2.3':43B,107C '3.1':141C,153C '7.5':76B,144C 'access':67B,119C 'account':64B 'affect':105C 'allow':113C 'api':52B,100C 'app':22B 'attack':55B,116C,128C 'avail':83B,148C 'base':142C 'busi':40B,96C 'compon':98C 'compromis':70B,123C 'confidenti':80B,145C 'could':68B 'cve':14A,17A 'cvss':75B,140C,150C,152C 'difficult':109C 'e':39B,95C 'e-busi':38B,94C 'eb':25B 'enterpris':21B 'enterprise-app':20B 'exploit':111C 'flaw':48B 'foundat':3A,29B,36B,90C,126C,139C 'fulli':69B 'h':162C 'h/a':161C 'h/i':160C 'h/pr':156C 'high':79B 'host':32B 'http':59B,121C 'impact':84B,149C 'integr':81B,146C 'l/ui':157C 'low':5A,62B,114C 'low-privileg':4A,61B 'n/ac':155C 'n/s':158C 'network':7A,66B,118C 'oracl':1A,24B,27B,34B,88C,93C,124C,137C 'oracle-eb':23B 'oracle-sales-found':26B 'per':73B 'privileg':6A,63B,115C 'product':13A,72B,91C 'reach':57B 'result':133C 'sale':2A,28B,35B,89C,125C,138C 'score':77B,143C 'secur':51B,99C 'self':31B 'self-host':30B 'success':127C 'suit':41B,97C 'support':101C 'take':10A 'takeov':135C 'u/c':159C 'user':8A 'vector':151C 'vendor':33B 'version':42B,102C 'via':120C 'vulner':85C,112C,131C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite 12.2 with the Oracle Sales Foundation component in the affected range `12.2.3` through `12.2.15`, reachable over HTTP. Teams not running Oracle E-Business Suite or Sales Foundation can skip it. The sources do not say whether specific configurations change exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101535","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101535","severity":null,"published_at":"2026-10-20T22:18:02+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}