---
id: "CVE-2026-101642"
kind: "vulnerability"
aliases: ["CVE-2026-101642"]
title: "Oracle E-Business Suite Report Manager: low-privilege users can read critical data"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["enterprise-erp", "oracle-ebs", "self-hosted", "vendor"]
not_affected_if: ["component-not-deployed", "unsupported-version-range"]
published_at: "2026-10-20T22:18:18+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T03:34:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101642", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Oracle E-Business Suite Report Manager: low-privilege users can read critical data

Oracle E-Business Suite's Report Manager component, in the Internal Operations area, has a flaw that lets a low-privileged user reach it over HTTPS and access data they should not see. A successful attack can also partly disrupt the service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the installed Oracle E-Business Suite release is within 12.2.3 to 12.2.15 (unknown exact patch level from sources)
- Check whether the Report Manager / Internal Operations component is reachable over the network

## Fix

- Apply the Oracle Critical Patch Update for Oracle E-Business Suite that covers this CVE (patch identifier unknown from sources)

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101642

## From the sources

Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Report Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Report Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Report Manager. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_