{"id":"CVE-2026-101650","kind":"vulnerability","aliases":["CVE-2026-101650"],"related":[],"title":"Oracle E-Business Suite: Partner Management flaw lets low-privilege users change data","description":"Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Partner Management.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Partner Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Partner Management. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).","summary":"Oracle Partner Management, part of Oracle E-Business Suite, has a flaw in its Internal Operations component that can be reached over HTTP. An attacker with a low-privilege account on the network can create, delete or modify critical data and partly disrupt the service.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erp","oracle-ebs","partner-management","self-hosted","vendor"],"not_affected_if":["module-not-installed","release-outside-range"],"how_to_check":"- Confirm whether Oracle Partner Management is installed in your Oracle E-Business Suite environment\n- Check the installed E-Business Suite release against the affected range `12.2.3` to `12.2.15` in the Oracle advisory\n- unknown for any further check, as the sources do not say","fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Partner Management, moving past `12.2.15`\n- unknown for specific patch numbers, as the sources do not say","status":"open","published_at":"2026-10-20T22:18:19+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:34:26+00:00","updated_at":"2026-10-25T03:34:26+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:34:26Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Partner Management, moving past `12.2.15`\n- unknown for specific patch numbers, as the sources do not say","reach":"network","title":"Oracle E-Business Suite: Partner Management flaw lets low-privilege users change data","impact":"medium","summary":"Oracle Partner Management, part of Oracle E-Business Suite, has a flaw in its Internal Operations component that can be reached over HTTP. An attacker with a low-privilege account on the network can create, delete or modify critical data and partly disrupt the service.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","partner-management","erp","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker alters or deletes critical partner data and partly disrupts the service","analyst_note":"Find the Oracle Critical Patch Update advisory for CVE-2026-101650 to confirm the patched release and the exact module check.","how_to_check":"- Confirm whether Oracle Partner Management is installed in your Oracle E-Business Suite environment\n- Check the installed E-Business Suite release against the affected range `12.2.3` to `12.2.15` in the Oracle advisory\n- unknown for any further check, as the sources do not say","needs_analyst":true,"not_affected_if":["module-not-installed","release-outside-range"],"who_is_affected":"Organisations running Oracle E-Business Suite release 12.2.3 through 12.2.15 with the Oracle Partner Management module deployed. Systems without that module or outside that release range are not affected by this entry.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000656,"input_tokens":3500,"output_tokens":613,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101650':18A,21A '-2026':17A,20A '/av':174C '12.2.15':103C '12.2.3':102C '3.1':162C,173C '7.1':165C 'abil':147C 'access':113C,134C,143C 'account':64B 'affect':100C 'allow':107C 'attack':58B,110C,122C 'avail':168C 'base':163C 'busi':4A,41B,91C 'caus':149C 'chang':14A 'compon':50B,93C 'compromis':117C 'creat':69B 'creation':130C 'critic':73B,136C 'cve':16A,19A 'cvss':161C,170C,172C 'data':15A,74B,137C,144C 'delet':70B,131C 'denial':152C 'disrupt':77B 'dos':156C 'e':3A,40B,90C 'e-busi':2A,39B,89C 'easili':104C 'eb':25B 'erp':22B 'exploit':105C 'flaw':8A,45B 'h/a':181C 'host':31B 'http':56B,115C 'impact':169C 'integr':166C 'intern':48B,94C 'l':182C 'l/pr':176C 'l/ui':177C 'let':9A 'low':11A,62B,108C 'low-privileg':10A,61B 'manag':7A,28B,35B,85C,120C,142C,160C 'modif':133C 'modifi':72B 'n/ac':175C 'n/i':180C 'n/s':178C 'network':67B,112C 'oper':49B,95C 'oracl':1A,24B,33B,38B,83C,88C,118C,140C,158C 'oracle-eb':23B 'part':36B,76B 'partial':151C,155C 'partner':6A,27B,34B,84C,119C,141C,159C 'partner-manag':26B 'privileg':12A,63B,109C 'product':86C 'reach':54B 'result':127C 'score':164C 'self':30B 'self-host':29B 'servic':79B,154C 'success':121C 'suit':5A,42B,92C 'support':96C 'u/c':179C 'unauthor':129C,146C 'user':13A 'vector':171C 'vendor':32B 'version':97C 'via':114C 'vulner':80C,106C,125C","nicknames":[],"mitigations":[],"who_affected":"Organisations running Oracle E-Business Suite release 12.2.3 through 12.2.15 with the Oracle Partner Management module deployed. Systems without that module or outside that release range are not affected by this entry.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101650","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101650","severity":null,"published_at":"2026-10-20T22:18:19+00:00","modified_at":"2026-10-21T19:16:53+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}