---
id: "CVE-2026-101681"
kind: "vulnerability"
aliases: ["CVE-2026-101681"]
title: "Oracle E-Business Suite: Applications DBA AD Utilities allows takeover by local users"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["applications-dba", "oracle-ebs", "self-hosted", "vendor"]
not_affected_if: ["no-shell-access", "unsupported-release"]
published_at: "2026-10-20T22:18:22+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T03:38:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101681", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Oracle E-Business Suite: Applications DBA AD Utilities allows takeover by local users

Oracle E-Business Suite's Applications DBA component, in the AD Utilities area, has a flaw that lets a low-privileged user who can log on to the host take over the product. The sources say a successful attack can give full confidentiality, integrity and availability impact on Applications DBA.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Oracle E-Business Suite release: affected supported versions are 12.2.3 through 12.2.15, so look for `12.2.x` in that range.
- Confirm whether Applications DBA (AD Utilities) is in use on the host: unknown.

## Fix

- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Applications DBA: unknown (the sources do not name the patch or fixed version).
- Restrict shell logons to the Applications DBA host to trusted administrators: unknown.

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101681

## From the sources

Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_