---
id: "CVE-2026-101536"
kind: "vulnerability"
aliases: ["CVE-2026-101536"]
title: "Oracle E-Business Suite Cost Management: low-privilege HTTP flaw allows full takeover"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["erp", "oracle-cost-management", "oracle-ebs", "package", "self-hosted"]
not_affected_if: ["module-not-installed", "version-outside-range"]
published_at: "2026-10-20T22:18:03+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T03:20:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101536", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Oracle E-Business Suite Cost Management: low-privilege HTTP flaw allows full takeover

Oracle E-Business Suite's Cost Management module, in the Cost Maintenance component, has a flaw that lets a low-privileged user reach it over HTTP. A successful attack can take over the Cost Management product, with high confidentiality, integrity and availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the Oracle E-Business Suite release level in use, for example by checking the installed patch level in Oracle Applications Manager, unknown if the sources do not name the exact check
- Check whether Oracle Cost Management is installed and in use, unknown if the sources do not say how to confirm the module
- Compare the installed version against the affected range 12.2.3 to 12.2.15

## Fix

- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Cost Management, unknown if the sources do not name the exact patch
- Move to a supported release outside the affected range 12.2.3 to 12.2.15, unknown if the sources do not name the target version

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101536

## From the sources

Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Maintenance).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management.  Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_