{"id":"CVE-2026-101545","kind":"vulnerability","aliases":["CVE-2026-101545"],"related":[],"title":"Oracle E-Business Suite: Inventory Management flaw lets local users take over","description":"Vulnerability in the Oracle Inventory Management product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Inventory Management executes to compromise Oracle Inventory Management.  Successful attacks of this vulnerability can result in takeover of Oracle Inventory Management. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Inventory Management, part of Oracle E-Business Suite, has a flaw in its Internal Operations component. A low-privileged user with logon to the host running it can fully compromise the product, reading, changing and disrupting its data.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erp","inventory-management","oracle-ebs","package","self-hosted"],"not_affected_if":["inventory-module-not-used","other-release"],"how_to_check":"- Check the installed E-Business Suite release level against the affected range `12.2.3` to `12.2.15` (unknown how the sources expect this to be read from the instance)\n- Confirm whether Inventory Management is licensed and in use on the instance (unknown from the sources)","fix":"- Apply the Oracle Critical Patch Update for E-Business Suite that covers this CVE (unknown which patch number the sources name)\n- Move to a supported E-Business Suite release outside `12.2.3` to `12.2.15` (unknown target version from the sources)","status":"open","published_at":"2026-10-20T22:18:04+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:38:17+00:00","updated_at":"2026-10-25T03:38:17+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:38:17Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update for E-Business Suite that covers this CVE (unknown which patch number the sources name)\n- Move to a supported E-Business Suite release outside `12.2.3` to `12.2.15` (unknown target version from the sources)","reach":"local","title":"Oracle E-Business Suite: Inventory Management flaw lets local users take over","impact":"high","summary":"Oracle Inventory Management, part of Oracle E-Business Suite, has a flaw in its Internal Operations component. A low-privileged user with logon to the host running it can fully compromise the product, reading, changing and disrupting its data.","category":"package","nicknames":[],"who_cares":["oracle-ebs","inventory-management","self-hosted","erp"],"confidence":0.6,"needs_auth":"yes","worst_case":"local low-privileged user takes over Inventory Management data and service","analyst_note":"Check Oracle's Security Alert advisory for the patch number and exact affected versions, since the NVD text is the only source.","how_to_check":"- Check the installed E-Business Suite release level against the affected range `12.2.3` to `12.2.15` (unknown how the sources expect this to be read from the instance)\n- Confirm whether Inventory Management is licensed and in use on the instance (unknown from the sources)","needs_analyst":true,"not_affected_if":["other-release","inventory-module-not-used"],"who_is_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with Oracle Inventory Management in use. The attacker needs an account on the infrastructure where the product runs, so exposure depends on who has logon to those hosts. Teams on other E-Business Suite releases or without Inventory Management can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000669,"input_tokens":3470,"output_tokens":644,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101545':15A,18A '-2026':14A,17A '/av':145C '12.2.15':94C '12.2.3':93C '3.1':132C,144C '7.0':135C 'affect':91C 'allow':99C 'attack':102C,119C 'avail':139C 'base':133C 'busi':4A,38B,82C 'chang':66B 'compon':47B,84C 'compromis':62B,114C 'confidenti':136C 'cve':13A,16A 'cvss':131C,141C,143C 'data':70B 'difficult':95C 'disrupt':68B 'e':3A,37B,81C 'e-busi':2A,36B,80C 'eb':25B 'erp':19B 'execut':112C 'exploit':97C 'flaw':8A,42B 'fulli':61B 'h':153C 'h/a':152C 'h/i':151C 'h/pr':147C 'host':29B,57B 'impact':140C 'infrastructur':107C 'integr':137C 'intern':45B,85C 'inventori':6A,21B,31B,75C,110C,116C,129C 'inventory-manag':20B 'l/ac':146C 'l/ui':148C 'let':9A 'local':10A 'logon':54B,104C 'low':50B,100C 'low-privileg':49B 'manag':7A,22B,32B,76C,111C,117C,130C 'n/s':149C 'oper':46B,86C 'oracl':1A,24B,30B,35B,74C,79C,109C,115C,128C 'oracle-eb':23B 'packag':26B 'part':33B 'privileg':51B,101C 'product':64B,77C 'read':65B 'result':124C 'run':58B 'score':134C 'self':28B 'self-host':27B 'success':118C 'suit':5A,39B,83C 'support':87C 'take':12A 'takeov':126C 'u/c':150C 'user':11A,52B 'vector':142C 'version':88C 'vulner':71C,98C,122C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with Oracle Inventory Management in use. The attacker needs an account on the infrastructure where the product runs, so exposure depends on who has logon to those hosts. Teams on other E-Business Suite releases or without Inventory Management can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101545","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101545","severity":null,"published_at":"2026-10-20T22:18:04+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}