{"id":"CVE-2026-101681","kind":"vulnerability","aliases":["CVE-2026-101681"],"related":[],"title":"Oracle E-Business Suite: Applications DBA AD Utilities allows takeover by local users","description":"Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle E-Business Suite's Applications DBA component, in the AD Utilities area, has a flaw that lets a low-privileged user who can log on to the host take over the product. The sources say a successful attack can give full confidentiality, integrity and availability impact on Applications DBA.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["applications-dba","oracle-ebs","self-hosted","vendor"],"not_affected_if":["no-shell-access","unsupported-release"],"how_to_check":"- Check the installed Oracle E-Business Suite release: affected supported versions are 12.2.3 through 12.2.15, so look for `12.2.x` in that range.\n- Confirm whether Applications DBA (AD Utilities) is in use on the host: unknown.","fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Applications DBA: unknown (the sources do not name the patch or fixed version).\n- Restrict shell logons to the Applications DBA host to trusted administrators: unknown.","status":"open","published_at":"2026-10-20T22:18:22+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:38:14+00:00","updated_at":"2026-10-25T03:38:14+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:38:14Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Applications DBA: unknown (the sources do not name the patch or fixed version).\n- Restrict shell logons to the Applications DBA host to trusted administrators: unknown.","reach":"local","title":"Oracle E-Business Suite: Applications DBA AD Utilities allows takeover by local users","impact":"high","summary":"Oracle E-Business Suite's Applications DBA component, in the AD Utilities area, has a flaw that lets a low-privileged user who can log on to the host take over the product. The sources say a successful attack can give full confidentiality, integrity and availability impact on Applications DBA.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","applications-dba","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Low-privileged local user takes over Applications DBA, reading and changing data","analyst_note":"Find the Oracle Critical Patch Update advisory and the patch that fixes Applications DBA AD Utilities for 12.2.3-12.2.15, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-101681.","how_to_check":"- Check the installed Oracle E-Business Suite release: affected supported versions are 12.2.3 through 12.2.15, so look for `12.2.x` in that range.\n- Confirm whether Applications DBA (AD Utilities) is in use on the host: unknown.","needs_analyst":true,"not_affected_if":["unsupported-release","no-shell-access"],"who_is_affected":"Teams running Oracle E-Business Suite 12.2.3 through 12.2.15 where Applications DBA runs on a host that low-privileged users can log on to. The attack is rated difficult, so exposure depends on who holds logons on that infrastructure. Teams on other releases or without that host access can likely skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.0007,"input_tokens":3450,"output_tokens":709,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101681':17A,20A '-2026':16A,19A '/av':153C '12.2.15':105C '12.2.3':104C '3.1':140C,152C '7.0':143C 'ad':8A,42B,96C 'affect':102C 'allow':10A,110C 'applic':6A,22B,37B,81B,86C,120C,125C,137C 'applications-dba':21B 'area':44B 'attack':71B,113C,128C 'avail':78B,147C 'base':141C 'busi':4A,34B,93C 'compon':39B,95C 'compromis':124C 'confidenti':75B,144C 'cve':15A,18A 'cvss':139C,149C,151C 'dba':7A,23B,38B,82B,87C,121C,126C,138C 'difficult':106C 'e':3A,33B,92C 'e-busi':2A,32B,91C 'eb':26B 'execut':122C 'exploit':108C 'flaw':47B 'full':74B 'give':73B 'h':161C 'h/a':160C 'h/i':159C 'h/pr':155C 'host':29B,61B 'impact':79B,148C 'infrastructur':118C 'integr':76B,145C 'l/ac':154C 'l/ui':156C 'let':49B 'local':13A 'log':57B 'logon':115C 'low':52B,111C 'low-privileg':51B 'n/s':157C 'oracl':1A,25B,31B,90C 'oracle-eb':24B 'privileg':53B,112C 'product':65B,88C 'result':133C 'say':68B 'score':142C 'self':28B 'self-host':27B 'sourc':67B 'success':70B,127C 'suit':5A,35B,94C 'support':98C 'take':62B 'takeov':11A,135C 'u/c':158C 'user':14A,54B 'util':9A,43B,97C 'vector':150C 'vendor':30B 'version':99C 'vulner':83C,109C,131C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle E-Business Suite 12.2.3 through 12.2.15 where Applications DBA runs on a host that low-privileged users can log on to. The attack is rated difficult, so exposure depends on who holds logons on that infrastructure. Teams on other releases or without that host access can likely skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101681","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101681","severity":null,"published_at":"2026-10-20T22:18:22+00:00","modified_at":"2026-10-21T21:17:35+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}