{"id":"CVE-2026-101552","kind":"vulnerability","aliases":["CVE-2026-101552"],"related":[],"title":"Oracle E-Business Suite: Flexfields flaw lets low-privilege users take over Application Object Library","description":"Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Flexfields).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle E-Business Suite's Application Object Library component, in the Flexfields feature, contains a flaw that a low-privileged user can reach over HTTP. A successful attack can lead to full takeover of that component, with high confidentiality, integrity and availability impact.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erp","oracle-ebs","self-hosted","vendor"],"not_affected_if":["no-http-exposure","unsupported-version"],"how_to_check":"- Check the installed Oracle E-Business Suite release level and compare it with the affected range 12.2.3 through 12.2.15 named in the advisory.\n- unknown for any further check, since the sources do not say which file, setting or patch level to inspect.","fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Application Object Library, moving off the affected 12.2.3-12.2.15 range.\n- unknown for the exact patch number, since the sources do not name it.","status":"open","published_at":"2026-10-20T22:18:04+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:20:24+00:00","updated_at":"2026-10-25T03:20:24+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-25T03:20:24Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Application Object Library, moving off the affected 12.2.3-12.2.15 range.\n- unknown for the exact patch number, since the sources do not name it.","reach":"network","title":"Oracle E-Business Suite: Flexfields flaw lets low-privilege users take over Application Object Library","impact":"high","summary":"Oracle E-Business Suite's Application Object Library component, in the Flexfields feature, contains a flaw that a low-privileged user can reach over HTTP. A successful attack can lead to full takeover of that component, with high confidentiality, integrity and availability impact.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","self-hosted","erp"],"confidence":0.8,"needs_auth":"yes","worst_case":"Low-privileged user takes over the Application Object Library component","analyst_note":"Confirm the Oracle Security Alert or CPU patch identifier and the exact fixed patch level on the Oracle advisory page, since the sources give only the affected range.","how_to_check":"- Check the installed Oracle E-Business Suite release level and compare it with the affected range 12.2.3 through 12.2.15 named in the advisory.\n- unknown for any further check, since the sources do not say which file, setting or patch level to inspect.","needs_analyst":true,"not_affected_if":["unsupported-version","no-http-exposure"],"who_is_affected":"Organisations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Application Object Library exposed over HTTP are in scope. Sites on releases outside that range, or with no reachable HTTP path to the suite, are not affected by the listed versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000665,"input_tokens":3453,"output_tokens":640,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101552':20A,23A '-2026':19A,22A '/av':148C '12.2.15':100C '12.2.3':99C '3.1':135C,147C '7.5':138C 'access':111C 'affect':97C 'allow':105C 'applic':15A,38B,81C,117C,131C 'attack':61B,108C,121C 'avail':75B,142C 'base':136C 'busi':4A,35B,89C 'compon':41B,69B,91C 'compromis':115C 'confidenti':72B,139C 'contain':46B 'cve':18A,21A 'cvss':134C,144C,146C 'difficult':101C 'e':3A,34B,88C 'e-busi':2A,33B,87C 'eb':27B 'erp':24B 'exploit':103C 'featur':45B 'flaw':7A,48B 'flexfield':6A,44B,92C 'full':65B 'h':156C 'h/a':155C 'h/i':154C 'h/pr':150C 'high':71B 'host':30B 'http':58B,113C 'impact':76B,143C 'integr':73B,140C 'l/ui':151C 'lead':63B 'let':8A 'librari':17A,40B,83C,119C,133C 'low':10A,52B,106C 'low-privileg':9A,51B 'n/ac':149C 'n/s':152C 'network':110C 'object':16A,39B,82C,118C,132C 'oracl':1A,26B,32B,80C,86C,116C,130C 'oracle-eb':25B 'privileg':11A,53B,107C 'product':84C 'reach':56B 'result':126C 'score':137C 'self':29B 'self-host':28B 'success':60B,120C 'suit':5A,36B,90C 'support':93C 'take':13A 'takeov':66B,128C 'u/c':153C 'user':12A,54B 'vector':145C 'vendor':31B 'version':94C 'via':112C 'vulner':77C,104C,124C","nicknames":[],"mitigations":[],"who_affected":"Organisations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Application Object Library exposed over HTTP are in scope. Sites on releases outside that range, or with no reachable HTTP path to the suite, are not affected by the listed versions.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101552","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101552","severity":null,"published_at":"2026-10-20T22:18:04+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}