{"id":"CVE-2026-101638","kind":"vulnerability","aliases":["CVE-2026-101638"],"related":[],"title":"Oracle E-Business Suite: AD Utilities flaw lets local users take over Applications DBA","description":"Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).","summary":"Oracle E-Business Suite's Applications DBA component, specifically its AD Utilities part, has a flaw affecting versions 12.2.3 through 12.2.15. A low-privileged user with logon access to the host running Applications DBA can take it over, but a second person must take an action for the attack to succeed.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["applications-dba","oracle-ebs","runtime","self-hosted"],"not_affected_if":["no-ebs-installed","unsupported-version"],"how_to_check":"- Confirm whether Oracle E-Business Suite 12.2.3 through 12.2.15 is installed, including the Applications DBA component\n- Check the installed AD Utilities patch level against Oracle's advisory (unknown from the sources)","fix":"- Apply the Oracle Critical Patch Update fix for AD Utilities (exact patch number unknown from the sources)\n- Move Oracle E-Business Suite to a supported release with the fix (version unknown from the sources)","status":"open","published_at":"2026-10-20T22:18:17+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:27:28+00:00","updated_at":"2026-10-25T03:27:28+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T03:27:28Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for AD Utilities (exact patch number unknown from the sources)\n- Move Oracle E-Business Suite to a supported release with the fix (version unknown from the sources)","reach":"local","title":"Oracle E-Business Suite: AD Utilities flaw lets local users take over Applications DBA","impact":"high","summary":"Oracle E-Business Suite's Applications DBA component, specifically its AD Utilities part, has a flaw affecting versions 12.2.3 through 12.2.15. A low-privileged user with logon access to the host running Applications DBA can take it over, but a second person must take an action for the attack to succeed.","category":"runtime","nicknames":[],"who_cares":["oracle-ebs","applications-dba","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker takes over Applications DBA, reading and changing its data","analyst_note":"Find Oracle's Critical Patch Update advisory for this CVE to confirm the patch version and check steps; the NVD entry has no fix details.","how_to_check":"- Confirm whether Oracle E-Business Suite 12.2.3 through 12.2.15 is installed, including the Applications DBA component\n- Check the installed AD Utilities patch level against Oracle's advisory (unknown from the sources)","needs_analyst":true,"not_affected_if":["unsupported-version","no-ebs-installed"],"who_is_affected":"Teams running Oracle E-Business Suite 12.2.3 through 12.2.15 with Applications DBA on the host are affected. The attacker needs a logon on the infrastructure where Applications DBA runs, so exposure is mainly from internal or shared hosts rather than the internet. Teams not running Oracle E-Business Suite in this version range can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000683,"input_tokens":3470,"output_tokens":672,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101638':18A,21A '-2026':17A,20A '/av':166C '12.2.15':53B,107C '12.2.3':51B,106C '3.1':153C,165C '7.3':156C 'access':61B 'action':79B 'ad':6A,43B,98C 'affect':49B,104C 'allow':111C 'applic':14A,23B,38B,66B,88C,121C,126C,150C 'applications-dba':22B 'attack':82B,114C,129C,139C,141C 'avail':160C 'base':154C 'busi':4A,35B,95C 'compon':40B,97C 'compromis':125C 'confidenti':157C 'cve':16A,19A 'cvss':152C,162C,164C 'dba':15A,24B,39B,67B,89C,122C,127C,151C 'e':3A,34B,94C 'e-busi':2A,33B,93C 'easili':108C 'eb':27B 'execut':123C 'exploit':109C 'flaw':8A,48B 'h':174C 'h/a':173C 'h/i':172C 'host':31B,64B 'human':131C 'impact':161C 'infrastructur':119C 'integr':158C 'interact':132C 'l/ac':167C 'l/pr':168C 'l/ui':169C 'let':9A 'local':10A 'logon':60B,116C 'low':56B,112C 'low-privileg':55B 'must':76B 'oracl':1A,26B,32B,92C 'oracle-eb':25B 'part':45B 'person':75B,135C 'privileg':57B,113C 'product':90C 'r/s':170C 'requir':130C 'result':146C 'run':65B 'runtim':28B 'score':155C 'second':74B 'self':30B 'self-host':29B 'specif':41B 'succeed':84B 'success':128C,140C 'suit':5A,36B,96C 'support':100C 'take':12A,69B,77B 'takeov':148C 'u/c':171C 'user':11A,58B 'util':7A,44B,99C 'vector':163C 'version':50B,101C 'vulner':85C,110C,144C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle E-Business Suite 12.2.3 through 12.2.15 with Applications DBA on the host are affected. The attacker needs a logon on the infrastructure where Applications DBA runs, so exposure is mainly from internal or shared hosts rather than the internet. Teams not running Oracle E-Business Suite in this version range can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101638","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101638","severity":null,"published_at":"2026-10-20T22:18:17+00:00","modified_at":"2026-10-21T19:16:52+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}