{"id":"CVE-2026-101542","kind":"vulnerability","aliases":["CVE-2026-101542"],"related":[],"title":"Oracle E-Business Suite Capacity: low-privilege HTTP attack takes over the app","description":"Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  Successful attacks of this vulnerability can result in takeover of Oracle Capacity. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Capacity (Internal Operations component) in E-Business Suite 12.2.3-12.2.15 has a flaw. A low-privileged authenticated user with HTTP access can take over the Capacity application. CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N). Fixed by the October 2026 Critical Patch Update.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle E-Business Suite (Capacity)","fixed":["Oct 2026 CPU, patch 40022426:12.2.0 (per Rapid7, unconfirmed by Oracle)"],"affected":">= 12.2.3, <= 12.2.15","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle","oracle-capacity","oracle-e-business-suite","self-hosted","vendor"],"not_affected_if":["capacity-not-installed","oracle-cloud-managed-patched","versions-outside-12.2.3-12.2.15"],"how_to_check":"Check whether Oracle Capacity is installed and licensed in your EBS 12.2.x instance, then check whether the Oct 2026 CPU EBS patch is applied. Rapid7 names patch 40022426 (verify in the Oracle MOS patch availability document). Also check for the patch with AD's adop patch history.","fix":"Apply the October 2026 Oracle Critical Patch Update for E-Business Suite. Rapid7 lists Patch 40022426:12.2.0. Confirm the number in Oracle's MOS patch availability document. Until then, limit HTTP access to EBS to trusted networks.","status":"open","published_at":"2026-10-20T22:18:03+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-23T22:32:41+00:00","updated_at":"2026-10-24T00:09:30+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T22:32:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle E-Business Suite Capacity: low-privilege HTTP attack takes over the app","impact":"high","summary":"Oracle Capacity in E-Business Suite versions 12.2.3 through 12.2.15 has a flaw in its Internal Operations component. A low-privileged user with network access over HTTP can take full control of the Capacity application, including reading, changing and disrupting its data.","category":"vendor","who_cares":["oracle-e-business-suite","oracle-capacity"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker takes over Oracle Capacity app, reads and changes its data","analyst_note":"Find Oracle's Critical Patch Update advisory and patch number for EBS 12.2.3-12.2.15 at https://nvd.nist.gov/vuln/detail/CVE-2026-101542 and confirm the fixed patch level.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["versions-outside-12.2.3-12.2.15"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000509,"input_tokens":3040,"output_tokens":409,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory and patch number for EBS 12.2.3-12.2.15 at https://nvd.nist.gov/vuln/detail/CVE-2026-101542 and confirm the fixed patch level.","search":"'-101542':18A,21A '-2026':17A,20A '/av':152C '12.2.15':52B,109C '12.2.3':51B,108C '2026':83B '3.1':72B,139C,151C '8.8':73B,142C 'access':64B,119C 'affect':106C 'allow':113C 'app':15A 'applic':70B 'attack':11A,116C,127C 'authent':60B 'av':74B 'avail':146C 'base':140C 'busi':4A,35B,49B,97C 'business':25A 'capac':6A,31B,42B,69B,91C,125C,137C 'capacity':27A 'compon':45B,99C 'compromis':123C 'confidenti':143C 'critic':84B 'cve':16A,19A 'cvss':71B,138C,148C,150C 'e':3A,24A,34B,48B,96C 'e-busi':2A,47B,95C 'e-business':23A 'easili':110C 'exploit':111C 'fix':79B 'flaw':55B 'h':160C 'h/a':159C 'h/i':158C 'host':39B 'http':10A,63B,121C 'impact':147C 'integr':144C 'intern':43B,100C 'l/pr':76B,154C 'l/ui':77B,155C 'low':8A,58B,114C 'low-privileg':7A,57B 'n':78B 'n/ac':75B,153C 'n/s':156C 'network':118C 'octob':82B 'oper':44B,101C 'oracl':1A,28B,30B,33B,41B,90C,94C,124C,136C 'oracle':22A 'oracle-capac':29B 'oracle-e-business-suit':32B 'patch':85B 'privileg':9A,59B,115C 'product':92C 'result':132C 'score':141C 'self':38B 'self-host':37B 'success':126C 'suit':5A,36B,50B,98C 'suite':26A 'support':102C 'take':12A,66B 'takeov':134C 'u/c':157C 'updat':86B 'user':61B 'vector':149C 'vendor':40B 'version':103C 'via':120C 'vulner':87C,112C,130C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101542","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101542","severity":null,"published_at":"2026-10-20T22:18:03+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101542:597","url":null,"severity":null,"published_at":"2026-10-24T00:09:30+00:00","modified_at":"2026-10-24T00:09:30+00:00","first_seen_at":"2026-10-24T00:09:30+00:00","fetched_at":"2026-10-24T00:09:30+00:00","note":"Oracle CPU Oct 2026 (oracle.com cpuoct2026) lists EBS 12.2.3-12.2.15 as affected; the CVE record and Rapid7 give the same range. The patch number 40022426:12.2.0 comes only from Rapid7. I could not read Oracle's own EBS patch availability doc (My Oracle Support login). No exploitation or public PoC reported in the sources I read; no community posts searched."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2384,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-101542/","title":"Rapid7: CVE-2026-101542 Oracle E-Business Suite","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}