---
id: "CVE-2026-101542"
kind: "vulnerability"
aliases: ["CVE-2026-101542"]
title: "Oracle E-Business Suite Capacity: low-privilege HTTP attack takes over the app"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Oracle E-Business Suite (Capacity)", "fixed": ["Oct 2026 CPU, patch 40022426:12.2.0 (per Rapid7, unconfirmed by Oracle)"], "affected": ">= 12.2.3, <= 12.2.15", "ecosystem": "vendor"}]
ecosystems: []
tags: ["oracle", "oracle-capacity", "oracle-e-business-suite", "self-hosted", "vendor"]
not_affected_if: ["capacity-not-installed", "oracle-cloud-managed-patched", "versions-outside-12.2.3-12.2.15"]
published_at: "2026-10-20T22:18:03+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-24T00:09:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101542", "first_seen_at": "2026-10-23T21:57:22+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:09:30+00:00"}]
---

# Oracle E-Business Suite Capacity: low-privilege HTTP attack takes over the app

Oracle Capacity (Internal Operations component) in E-Business Suite 12.2.3-12.2.15 has a flaw. A low-privileged authenticated user with HTTP access can take over the Capacity application. CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N). Fixed by the October 2026 Critical Patch Update.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle E-Business Suite (Capacity) affected >= 12.2.3, <= 12.2.15 fixed Oct 2026 CPU, patch 40022426:12.2.0 (per Rapid7, unconfirmed by Oracle)

## How to check

Check whether Oracle Capacity is installed and licensed in your EBS 12.2.x instance, then check whether the Oct 2026 CPU EBS patch is applied. Rapid7 names patch 40022426 (verify in the Oracle MOS patch availability document). Also check for the patch with AD's adop patch history.

## Fix

Apply the October 2026 Oracle Critical Patch Update for E-Business Suite. Rapid7 lists Patch 40022426:12.2.0. Confirm the number in Oracle's MOS patch availability document. Until then, limit HTTP access to EBS to trusted networks.

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101542
- 2026-10-24T00:09:30+00:00 analyst — Oracle CPU Oct 2026 (oracle.com cpuoct2026) lists EBS 12.2.3-12.2.15 as affected; the CVE record and Rapid7 give the same range. The patch number 40022426:12.2.0 comes only from Rapid7. I could not read Oracle's own EBS patch availability doc (My Oracle Support login). No exploitation or public PoC reported in the sources I read; no community posts searched.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [fix] Rapid7: CVE-2026-101542 Oracle E-Business Suite https://www.rapid7.com/db/vulnerabilities/cve-2026-101542/

## From the sources

Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  Successful attacks of this vulnerability can result in takeover of Oracle Capacity. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_