{"id":"CVE-2026-101683","kind":"vulnerability","aliases":["CVE-2026-101683"],"related":[],"title":"Oracle E-Business Suite: Applications DBA lets a local user take over","description":"Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle E-Business Suite's Applications DBA component (AD Utilities) has a flaw that lets a low-privileged user who can log on to the host take control of Applications DBA. A successful attack gives full confidentiality, integrity and availability impact on that component.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["applications-dba","erp","on-prem","oracle-ebs","package"],"not_affected_if":["no-local-logon","unsupported-version"],"how_to_check":"- Check the installed Oracle E-Business Suite release level in the environment, for example the Applications DBA version reported by the AD Utilities patch level, against the affected range `12.2.3` to `12.2.15`\n- Confirm which hosts run Applications DBA and who holds shell or logon access to them","fix":"- Apply the Oracle Critical Patch Update fix for CVE-2026-101683 to Oracle E-Business Suite Applications DBA (AD Utilities); the exact patch number is unknown from the sources\n- Restrict logon access to hosts where Applications DBA runs to administrators only","status":"open","published_at":"2026-10-20T22:18:22+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:38:13+00:00","updated_at":"2026-10-25T03:38:13+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:38:13Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for CVE-2026-101683 to Oracle E-Business Suite Applications DBA (AD Utilities); the exact patch number is unknown from the sources\n- Restrict logon access to hosts where Applications DBA runs to administrators only","reach":"local","title":"Oracle E-Business Suite: Applications DBA lets a local user take over","impact":"high","summary":"Oracle E-Business Suite's Applications DBA component (AD Utilities) has a flaw that lets a low-privileged user who can log on to the host take control of Applications DBA. A successful attack gives full confidentiality, integrity and availability impact on that component.","category":"package","nicknames":[],"who_cares":["oracle-ebs","applications-dba","on-prem","erp"],"confidence":0.6,"needs_auth":"yes","worst_case":"low-privileged local user takes over Applications DBA component","analyst_note":"Find the Oracle Security Alert or CPU advisory for CVE-2026-101683 to get the exact patch and fixed release; the NVD entry gives no fix version.","how_to_check":"- Check the installed Oracle E-Business Suite release level in the environment, for example the Applications DBA version reported by the AD Utilities patch level, against the affected range `12.2.3` to `12.2.15`\n- Confirm which hosts run Applications DBA and who holds shell or logon access to them","needs_analyst":true,"not_affected_if":["unsupported-version","no-local-logon"],"who_is_affected":"Teams running Oracle E-Business Suite 12.2.3 through 12.2.15 with Applications DBA on servers that local users can log on to. The attack needs a low-privileged logon to the infrastructure, so internet-only exposure without local accounts is lower risk. Teams on releases outside the listed range can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000683,"input_tokens":3450,"output_tokens":676,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101683':15A,18A '-2026':14A,17A '/av':146C '12.2.15':98C '12.2.3':97C '3.1':133C,145C '7.0':136C 'ad':39B,89C 'affect':95C 'allow':103C 'applic':6A,20B,36B,61B,79C,113C,118C,130C 'applications-dba':19B 'attack':65B,106C,121C 'avail':71B,140C 'base':134C 'busi':4A,33B,86C 'compon':38B,75B,88C 'compromis':117C 'confidenti':68B,137C 'control':59B 'cve':13A,16A 'cvss':132C,142C,144C 'dba':7A,21B,37B,62B,80C,114C,119C,131C 'difficult':99C 'e':3A,32B,85C 'e-busi':2A,31B,84C 'eb':28B 'erp':22B 'execut':115C 'exploit':101C 'flaw':43B 'full':67B 'give':66B 'h':154C 'h/a':153C 'h/i':152C 'h/pr':148C 'host':57B 'impact':72B,141C 'infrastructur':111C 'integr':69B,138C 'l/ac':147C 'l/ui':149C 'let':8A,45B 'local':10A 'log':53B 'logon':108C 'low':48B,104C 'low-privileg':47B 'n/s':150C 'on-prem':23B 'oracl':1A,27B,30B,83C 'oracle-eb':26B 'packag':29B 'prem':25B 'privileg':49B,105C 'product':81C 'result':126C 'score':135C 'success':64B,120C 'suit':5A,34B,87C 'support':91C 'take':12A,58B 'takeov':128C 'u/c':151C 'user':11A,50B 'util':40B,90C 'vector':143C 'version':92C 'vulner':76C,102C,124C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle E-Business Suite 12.2.3 through 12.2.15 with Applications DBA on servers that local users can log on to. The attack needs a low-privileged logon to the infrastructure, so internet-only exposure without local accounts is lower risk. Teams on releases outside the listed range can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101683","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101683","severity":null,"published_at":"2026-10-20T22:18:22+00:00","modified_at":"2026-10-21T21:17:36+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}