---
id: "CVE-2026-101552"
kind: "vulnerability"
aliases: ["CVE-2026-101552"]
title: "Oracle E-Business Suite: Flexfields flaw lets low-privilege users take over Application Object Library"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["erp", "oracle-ebs", "self-hosted", "vendor"]
not_affected_if: ["no-http-exposure", "unsupported-version"]
published_at: "2026-10-20T22:18:04+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T03:20:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101552", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Oracle E-Business Suite: Flexfields flaw lets low-privilege users take over Application Object Library

Oracle E-Business Suite's Application Object Library component, in the Flexfields feature, contains a flaw that a low-privileged user can reach over HTTP. A successful attack can lead to full takeover of that component, with high confidentiality, integrity and availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Oracle E-Business Suite release level and compare it with the affected range 12.2.3 through 12.2.15 named in the advisory.
- unknown for any further check, since the sources do not say which file, setting or patch level to inspect.

## Fix

- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Application Object Library, moving off the affected 12.2.3-12.2.15 range.
- unknown for the exact patch number, since the sources do not name it.

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101552

## From the sources

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Flexfields).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_