---
id: "CVE-2026-101545"
kind: "vulnerability"
aliases: ["CVE-2026-101545"]
title: "Oracle E-Business Suite: Inventory Management flaw lets local users take over"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["erp", "inventory-management", "oracle-ebs", "package", "self-hosted"]
not_affected_if: ["inventory-module-not-used", "other-release"]
published_at: "2026-10-20T22:18:04+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T03:38:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101545", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Oracle E-Business Suite: Inventory Management flaw lets local users take over

Oracle Inventory Management, part of Oracle E-Business Suite, has a flaw in its Internal Operations component. A low-privileged user with logon to the host running it can fully compromise the product, reading, changing and disrupting its data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed E-Business Suite release level against the affected range `12.2.3` to `12.2.15` (unknown how the sources expect this to be read from the instance)
- Confirm whether Inventory Management is licensed and in use on the instance (unknown from the sources)

## Fix

- Apply the Oracle Critical Patch Update for E-Business Suite that covers this CVE (unknown which patch number the sources name)
- Move to a supported E-Business Suite release outside `12.2.3` to `12.2.15` (unknown target version from the sources)

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101545

## From the sources

Vulnerability in the Oracle Inventory Management product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Inventory Management executes to compromise Oracle Inventory Management.  Successful attacks of this vulnerability can result in takeover of Oracle Inventory Management. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_