---
id: "CVE-2026-101535"
kind: "vulnerability"
aliases: ["CVE-2026-101535"]
title: "Oracle Sales Foundation: low-privileged network user can take over the product"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["enterprise-apps", "oracle-ebs", "oracle-sales-foundation", "self-hosted", "vendor"]
not_affected_if: ["not-running-ebs", "outside-affected-versions"]
published_at: "2026-10-20T22:18:02+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T03:20:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101535", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Oracle Sales Foundation: low-privileged network user can take over the product

Oracle Sales Foundation in E-Business Suite versions 12.2.3 through 12.2.15 has a flaw in its Security API that an attacker can reach over HTTP. A low-privileged account with network access could fully compromise the product, per the CVSS 7.5 score with high confidentiality, integrity and availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Oracle E-Business Suite release and whether Oracle Sales Foundation is in use, since the affected range is `12.2.3` through `12.2.15`
- Review the Oracle Critical Patch Update advisory for the patch level that covers this CVE; the sources do not name the patch

## Fix

- Apply the Oracle Critical Patch Update that addresses CVE-2026-101535 for Oracle Sales Foundation in E-Business Suite; the sources do not name the exact patch or fixed version
- Move to a supported E-Business Suite release newer than `12.2.15` if the patch is not available for the current version

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101535

## From the sources

Vulnerability in the Oracle Sales Foundation product of Oracle E-Business Suite (component: Security API).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Foundation.  Successful attacks of this vulnerability can result in takeover of Oracle Sales Foundation. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_