{"id":"CVE-2026-101536","kind":"vulnerability","aliases":["CVE-2026-101536"],"related":[],"title":"Oracle E-Business Suite Cost Management: low-privilege HTTP flaw allows full takeover","description":"Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Maintenance).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management.  Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle E-Business Suite's Cost Management module, in the Cost Maintenance component, has a flaw that lets a low-privileged user reach it over HTTP. A successful attack can take over the Cost Management product, with high confidentiality, integrity and availability impact.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erp","oracle-cost-management","oracle-ebs","package","self-hosted"],"not_affected_if":["module-not-installed","version-outside-range"],"how_to_check":"- Confirm the Oracle E-Business Suite release level in use, for example by checking the installed patch level in Oracle Applications Manager, unknown if the sources do not name the exact check\n- Check whether Oracle Cost Management is installed and in use, unknown if the sources do not say how to confirm the module\n- Compare the installed version against the affected range 12.2.3 to 12.2.15","fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Cost Management, unknown if the sources do not name the exact patch\n- Move to a supported release outside the affected range 12.2.3 to 12.2.15, unknown if the sources do not name the target version","status":"open","published_at":"2026-10-20T22:18:03+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:20:28+00:00","updated_at":"2026-10-25T03:20:28+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:20:28Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Cost Management, unknown if the sources do not name the exact patch\n- Move to a supported release outside the affected range 12.2.3 to 12.2.15, unknown if the sources do not name the target version","reach":"network","title":"Oracle E-Business Suite Cost Management: low-privilege HTTP flaw allows full takeover","impact":"high","summary":"Oracle E-Business Suite's Cost Management module, in the Cost Maintenance component, has a flaw that lets a low-privileged user reach it over HTTP. A successful attack can take over the Cost Management product, with high confidentiality, integrity and availability impact.","category":"package","nicknames":[],"who_cares":["oracle-ebs","oracle-cost-management","self-hosted","erp"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker takes over Oracle Cost Management, reading and changing its data","analyst_note":"Check Oracle's Critical Patch Update advisory for the exact patch and fixed release, and confirm the affected component's HTTP path; sources give no fix or detection steps.","how_to_check":"- Confirm the Oracle E-Business Suite release level in use, for example by checking the installed patch level in Oracle Applications Manager, unknown if the sources do not name the exact check\n- Check whether Oracle Cost Management is installed and in use, unknown if the sources do not say how to confirm the module\n- Compare the installed version against the affected range 12.2.3 to 12.2.15","needs_analyst":true,"not_affected_if":["module-not-installed","version-outside-range"],"who_is_affected":"Organisations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Oracle Cost Management module deployed are exposed. Exposure depends on the HTTP path reachable by a low-privileged user, so teams with no Cost Management module or without a versions in range can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000708,"input_tokens":3455,"output_tokens":725,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101536':18A,21A '-2026':17A,20A '/av':148C '12.2.15':102C '12.2.3':101C '3.1':135C,147C '7.5':138C 'access':113C 'affect':99C 'allow':13A,107C 'attack':64B,110C,122C 'avail':77B,142C 'base':136C 'busi':4A,37B,90C 'compon':47B,92C 'compromis':117C 'confidenti':74B,139C 'cost':6A,25B,40B,45B,69B,83C,93C,119C,132C 'cve':16A,19A 'cvss':134C,144C,146C 'difficult':103C 'e':3A,36B,89C 'e-busi':2A,35B,88C 'eb':29B 'erp':22B 'exploit':105C 'flaw':12A,50B 'full':14A 'h':156C 'h/a':155C 'h/i':154C 'h/pr':150C 'high':73B 'host':33B 'http':11A,61B,115C 'impact':78B,143C 'integr':75B,140C 'l/ui':151C 'let':52B 'low':9A,55B,108C 'low-privileg':8A,54B 'mainten':46B,94C 'manag':7A,26B,41B,70B,84C,120C,133C 'modul':42B 'n/ac':149C 'n/s':152C 'network':112C 'oracl':1A,24B,28B,34B,82C,87C,118C,131C 'oracle-cost-manag':23B 'oracle-eb':27B 'packag':30B 'privileg':10A,56B,109C 'product':71B,85C 'reach':58B 'result':127C 'score':137C 'self':32B 'self-host':31B 'success':63B,121C 'suit':5A,38B,91C 'support':95C 'take':66B 'takeov':15A,129C 'u/c':153C 'user':57B 'vector':145C 'version':96C 'via':114C 'vulner':79C,106C,125C","nicknames":[],"mitigations":[],"who_affected":"Organisations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Oracle Cost Management module deployed are exposed. Exposure depends on the HTTP path reachable by a low-privileged user, so teams with no Cost Management module or without a versions in range can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101536","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101536","severity":null,"published_at":"2026-10-20T22:18:03+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}