{"id":"CVE-2026-101682","kind":"vulnerability","aliases":["CVE-2026-101682"],"related":[],"title":"Oracle E-Business Suite: AD Utilities flaw lets local attacker take over DBA tooling","description":"Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","summary":"Oracle E-Business Suite's Applications DBA component, specifically AD Utilities, has a flaw in supported versions 12.2.3 through 12.2.15. An attacker who already has logon to the infrastructure where Applications DBA runs can compromise the product and take it over, with a person other than the attacker needing to take an action.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["applications-dba","on-prem-erp","oracle-ebs","package","self-hosted"],"not_affected_if":["no-local-logon","unsupported-version"],"how_to_check":"- Check the installed Oracle E-Business Suite release and AD Utilities patch level against Oracle's advisory for `12.2.3` through `12.2.15`.\n- Confirm whether Applications DBA runs on hosts that local users can log in to.","fix":"- Apply the Oracle Critical Patch Update fix for Applications DBA / AD Utilities as listed in Oracle's advisory; the exact patch number is unknown from these sources.","status":"open","published_at":"2026-10-20T22:18:22+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:08:56+00:00","updated_at":"2026-10-25T03:08:56+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:08:56Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Applications DBA / AD Utilities as listed in Oracle's advisory; the exact patch number is unknown from these sources.","reach":"local","title":"Oracle E-Business Suite: AD Utilities flaw lets local attacker take over DBA tooling","impact":"high","summary":"Oracle E-Business Suite's Applications DBA component, specifically AD Utilities, has a flaw in supported versions 12.2.3 through 12.2.15. An attacker who already has logon to the infrastructure where Applications DBA runs can compromise the product and take it over, with a person other than the attacker needing to take an action.","category":"package","nicknames":[],"who_cares":["oracle-ebs","applications-dba","self-hosted","on-prem-erp"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker takes over Applications DBA, affecting confidentiality, integrity and availability","analyst_note":"Check Oracle's CPU advisory for the patch number and affected AD Utilities patch level; sources do not give fix or check commands.","how_to_check":"- Check the installed Oracle E-Business Suite release and AD Utilities patch level against Oracle's advisory for `12.2.3` through `12.2.15`.\n- Confirm whether Applications DBA runs on hosts that local users can log in to.","needs_analyst":true,"not_affected_if":["unsupported-version","no-local-logon"],"who_is_affected":"Teams running Oracle E-Business Suite release 12.2.3 through 12.2.15 where Applications DBA is installed on a host that other people or accounts can log in to. The sources describe a local attacker with logon to that infrastructure, so systems reachable only by administrators with no other local users are lower risk.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000674,"input_tokens":3472,"output_tokens":653,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101682':18A,21A '-2026':17A,20A '/av':170C '12.2.15':56B,112C '12.2.3':54B,111C '3.1':157C,169C '7.8':160C 'action':89B 'ad':6A,46B,103C 'affect':109C 'allow':116C 'alreadi':60B 'applic':23B,42B,67B,93C,125C,130C,154C 'applications-dba':22B 'attack':11A,58B,84B,118C,133C,143C,145C 'avail':164C 'base':158C 'busi':4A,39B,100C 'compon':44B,102C 'compromis':71B,129C 'confidenti':161C 'cve':16A,19A 'cvss':156C,166C,168C 'dba':14A,24B,43B,68B,94C,126C,131C,155C 'e':3A,38B,99C 'e-busi':2A,37B,98C 'easili':113C 'eb':31B 'erp':28B 'execut':127C 'exploit':114C 'flaw':8A,50B 'h':178C 'h/a':177C 'h/i':176C 'host':35B 'human':135C 'impact':165C 'infrastructur':65B,123C 'integr':162C 'interact':136C 'l/ac':171C 'l/pr':172C 'let':9A 'local':10A 'logon':62B,120C 'n/ui':173C 'need':85B 'on-prem-erp':25B 'oracl':1A,30B,36B,97C 'oracle-eb':29B 'packag':32B 'person':80B,139C 'prem':27B 'product':73B,95C 'r/s':174C 'requir':134C 'result':150C 'run':69B 'score':159C 'self':34B 'self-host':33B 'specif':45B 'success':132C,144C 'suit':5A,40B,101C 'support':52B,105C 'take':12A,75B,87B 'takeov':152C 'tool':15A 'u/c':175C 'unauthent':117C 'util':7A,47B,104C 'vector':167C 'version':53B,106C 'vulner':90C,115C,148C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle E-Business Suite release 12.2.3 through 12.2.15 where Applications DBA is installed on a host that other people or accounts can log in to. The sources describe a local attacker with logon to that infrastructure, so systems reachable only by administrators with no other local users are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101682","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101682","severity":null,"published_at":"2026-10-20T22:18:22+00:00","modified_at":"2026-10-21T21:17:36+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}