{"id":"CVE-2026-101540","kind":"vulnerability","aliases":["CVE-2026-101540"],"related":[],"title":"Oracle E-Business Suite Capacity: low-privilege network attacker reads critical data","description":"Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  While the vulnerability is in Oracle Capacity, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Capacity accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","summary":"Oracle E-Business Suite's Capacity product, in the Internal Operations component, has a flaw that lets a low-privileged user reach it over HTTP. An attacker can gain unauthorized access to critical data in Capacity and may affect other products (scope change).","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise-apps","oracle-ebs","package"],"not_affected_if":["not-running-oracle-ebs-capacity"],"how_to_check":"- unknown","fix":"- Move Oracle E-Business Suite Capacity to a patched release per Oracle's April 2026 Critical Patch Update advisory, which the sources do not name; unknown exact fixed version","status":"open","published_at":"2026-10-20T22:18:03+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:10:45+00:00","updated_at":"2026-10-25T03:10:45+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:10:45Z","model":"claude-haiku-5-5","output":{"fix":"- Move Oracle E-Business Suite Capacity to a patched release per Oracle's April 2026 Critical Patch Update advisory, which the sources do not name; unknown exact fixed version","reach":"network","title":"Oracle E-Business Suite Capacity: low-privilege network attacker reads critical data","impact":"high","summary":"Oracle E-Business Suite's Capacity product, in the Internal Operations component, has a flaw that lets a low-privileged user reach it over HTTP. An attacker can gain unauthorized access to critical data in Capacity and may affect other products (scope change).","category":"package","nicknames":[],"who_cares":["oracle-ebs","enterprise-apps"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads critical Capacity data and affects other products","analyst_note":"Check Oracle's Security Alert advisory for the fixed patch level and any detection steps for Oracle E-Business Suite 12.2.3-12.2.15.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["not-running-oracle-ebs-capacity"],"who_is_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Capacity product deployed are affected. Sources do not say which configurations expose the HTTP path, so unknown whether internet-facing deployments are more exposed. Teams not running Oracle E-Business Suite Capacity can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000625,"input_tokens":3490,"output_tokens":551,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101540':17A,20A '-2026':16A,19A '/av':160C '12.2.15':95C '12.2.3':94C '3.1':150C,159C '7.7':153C 'access':60B,105C,136C,142C,147C 'addit':123C 'affect':68B,92C 'allow':99C 'app':23B 'attack':11A,56B,102C,119C,128C 'base':151C 'busi':4A,31B,83C 'c/c':165C 'capac':6A,34B,65B,77C,111C,118C,146C 'chang':72B,126C 'complet':141C 'compon':40B,85C 'compromis':109C 'confidenti':154C 'critic':13A,62B,138C 'cve':15A,18A 'cvss':149C,156C,158C 'data':14A,63B,139C,148C 'e':3A,30B,82C 'e-busi':2A,29B,81C 'easili':96C 'eb':26B 'enterpris':22B 'enterprise-app':21B 'exploit':97C 'flaw':43B 'gain':58B 'h/i':166C 'http':54B,107C 'impact':122C,155C 'intern':38B,86C 'l/pr':162C 'l/ui':163C 'let':45B 'low':8A,48B,100C 'low-privileg':7A,47B 'may':67B,120C 'n':168C 'n/a':167C 'n/ac':161C 'n/s':164C 'network':10A,104C 'oper':39B,87C 'oracl':1A,25B,28B,76C,80C,110C,117C,145C 'oracle-eb':24B 'packag':27B 'privileg':9A,49B,101C 'product':35B,70B,78C,124C 'reach':51B 'read':12A 'result':133C 'scope':71B,125C 'score':152C 'signific':121C 'success':127C 'suit':5A,32B,84C 'support':88C 'unauthor':59B,135C 'user':50B 'vector':157C 'version':89C 'via':106C 'vulner':73C,98C,114C,131C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Capacity product deployed are affected. Sources do not say which configurations expose the HTTP path, so unknown whether internet-facing deployments are more exposed. Teams not running Oracle E-Business Suite Capacity can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101540","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101540","severity":null,"published_at":"2026-10-20T22:18:03+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}