{"id":"CVE-2026-101567","kind":"vulnerability","aliases":["CVE-2026-101567"],"related":[],"title":"Oracle E-Business Suite Cost Management: low-privilege user can take over over HTTP","description":"Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management.  Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle E-Business Suite Cost Management (Cost Planning component), 12.2.3 to 12.2.15, has a privilege flaw. A low-privileged authenticated user with HTTP access can take over Cost Management (CVSS 8.8, CWE-269). Fixed in the October 2026 Critical Patch Update. No known exploitation or public PoC.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle E-Business Suite Cost Management","fixed":[],"affected":">= 12.2.3, <= 12.2.15","ecosystem":"vendor"}],"ecosystems":[],"tags":["cost-management","oracle-e-business-suite","runtime","self-hosted"],"not_affected_if":["managed-hosting","versions-outside-12.2.3-12.2.15"],"how_to_check":"Check your EBS release is 12.2.3-12.2.15 (Oracle Applications Manager > Site Map > Patching, or SELECT release_name FROM fnd_product_groups). Then check in AD_BUGS / the patch history that the October 2026 CPU EBS patch from Oracle's Patch Availability Document (MOS) is applied. If it is not, you are exposed if Cost Management is licensed and in use.","fix":"Apply the Oracle E-Business Suite patches from the October 2026 Critical Patch Update, using the EBS Patch Availability Document on My Oracle Support (exact patch number not public; unknown here). Until then, restrict network access to EBS web tier and review low-privilege accounts with Cost Management responsibilities.","status":"open","published_at":"2026-10-20T22:18:08+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-23T22:32:38+00:00","updated_at":"2026-10-24T00:08:33+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T22:32:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Oracle E-Business Suite Cost Management: low-privilege user can take over over HTTP","impact":"high","summary":"Oracle E-Business Suite's Cost Management module (Cost Planning component), versions 12.2.3 to 12.2.15, has a flaw that lets a low-privileged logged-in user reach it over HTTP. A successful attack gives the attacker full takeover of Cost Management, with high impact to confidentiality, integrity and availability.","category":"runtime","who_cares":["oracle-e-business-suite","cost-management","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker takes over Cost Management, reading and changing its data","analyst_note":"Check Oracle's Critical Patch Update advisory for the patch level that fixes Cost Planning in 12.2.3-12.2.15; the NVD entry gives no fix version or check command.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["versions-outside-12.2.3-12.2.15"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000511,"input_tokens":3044,"output_tokens":413,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Oracle's Critical Patch Update advisory for the patch level that fixes Cost Planning in 12.2.3-12.2.15; the NVD entry gives no fix version or check command.","search":"'-101567':19A,22A '-2026':18A,21A '-269':76B '/av':159C '12.2.15':54B,114C '12.2.3':52B,113C '2026':81B '3.1':146C,158C '8.8':74B,149C 'access':67B,124C 'affect':111C 'allow':118C 'attack':121C,133C 'authent':63B 'avail':153C 'base':147C 'busi':4A,36B,45B,102C 'business':26A 'compon':51B,104C 'compromis':128C 'confidenti':150C 'cost':6A,28A,31B,47B,49B,71B,95C,105C,130C,143C 'cost-manag':30B 'critic':82B 'cve':17A,20A 'cvss':73B,145C,155C,157C 'cwe':75B 'e':3A,25A,35B,44B,101C 'e-busi':2A,43B,100C 'e-business':24A 'easili':115C 'exploit':87B,116C 'fix':77B 'flaw':58B 'h':167C 'h/a':166C 'h/i':165C 'host':41B 'http':16A,66B,126C 'impact':154C 'integr':151C 'known':86B 'l/pr':161C 'l/ui':162C 'low':9A,61B,119C 'low-privileg':8A,60B 'manag':7A,32B,48B,72B,96C,131C,144C 'management':29A 'n/ac':160C 'n/s':163C 'network':123C 'octob':80B 'oracl':1A,34B,42B,94C,99C,129C,142C 'oracle':23A 'oracle-e-business-suit':33B 'patch':83B 'plan':50B,106C 'poc':90B 'privileg':10A,57B,62B,120C 'product':97C 'public':89B 'result':138C 'runtim':38B 'score':148C 'self':40B 'self-host':39B 'success':132C 'suit':5A,37B,46B,103C 'suite':27A 'support':107C 'take':13A,69B 'takeov':140C 'u/c':164C 'updat':84B 'user':11A,64B 'vector':156C 'version':108C 'via':125C 'vulner':91C,117C,136C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101567","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101567","severity":null,"published_at":"2026-10-20T22:18:08+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101567:596","url":null,"severity":null,"published_at":"2026-10-24T00:08:33+00:00","modified_at":"2026-10-24T00:08:33+00:00","first_seen_at":"2026-10-24T00:08:33+00:00","fetched_at":"2026-10-24T00:08:33+00:00","note":"Oracle CPU Oct 2026 (20 Oct) lists EBS 12.2.3-12.2.15; CVE record confirms Cost Planning, CVSS 8.8 CWE-269. Patch number is in the MOS patch availability doc (login required), not read; no exploitation or PoC found (not in KEV, VulDB says no exploit). Did not search social."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2374,"url":"https://www.cve.org/CVERecord?id=CVE-2026-101567","title":"CVE Record: CVE-2026-101567","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}