---
id: "CVE-2026-101567"
kind: "vulnerability"
aliases: ["CVE-2026-101567"]
title: "Oracle E-Business Suite Cost Management: low-privilege user can take over over HTTP"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Oracle E-Business Suite Cost Management", "fixed": [], "affected": ">= 12.2.3, <= 12.2.15", "ecosystem": "vendor"}]
ecosystems: []
tags: ["cost-management", "oracle-e-business-suite", "runtime", "self-hosted"]
not_affected_if: ["managed-hosting", "versions-outside-12.2.3-12.2.15"]
published_at: "2026-10-20T22:18:08+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-24T00:08:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101567", "first_seen_at": "2026-10-23T21:57:22+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:08:33+00:00"}]
---

# Oracle E-Business Suite Cost Management: low-privilege user can take over over HTTP

Oracle E-Business Suite Cost Management (Cost Planning component), 12.2.3 to 12.2.15, has a privilege flaw. A low-privileged authenticated user with HTTP access can take over Cost Management (CVSS 8.8, CWE-269). Fixed in the October 2026 Critical Patch Update. No known exploitation or public PoC.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle E-Business Suite Cost Management affected >= 12.2.3, <= 12.2.15 fixed ?

## How to check

Check your EBS release is 12.2.3-12.2.15 (Oracle Applications Manager > Site Map > Patching, or SELECT release_name FROM fnd_product_groups). Then check in AD_BUGS / the patch history that the October 2026 CPU EBS patch from Oracle's Patch Availability Document (MOS) is applied. If it is not, you are exposed if Cost Management is licensed and in use.

## Fix

Apply the Oracle E-Business Suite patches from the October 2026 Critical Patch Update, using the EBS Patch Availability Document on My Oracle Support (exact patch number not public; unknown here). Until then, restrict network access to EBS web tier and review low-privilege accounts with Cost Management responsibilities.

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101567
- 2026-10-24T00:08:33+00:00 analyst — Oracle CPU Oct 2026 (20 Oct) lists EBS 12.2.3-12.2.15; CVE record confirms Cost Planning, CVSS 8.8 CWE-269. Patch number is in the MOS patch availability doc (login required), not read; no exploitation or PoC found (not in KEV, VulDB says no exploit). Did not search social.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-101567 https://www.cve.org/CVERecord?id=CVE-2026-101567

## From the sources

Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management.  Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_