---
id: "CVE-2026-101683"
kind: "vulnerability"
aliases: ["CVE-2026-101683"]
title: "Oracle E-Business Suite: Applications DBA lets a local user take over"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["applications-dba", "erp", "on-prem", "oracle-ebs", "package"]
not_affected_if: ["no-local-logon", "unsupported-version"]
published_at: "2026-10-20T22:18:22+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T03:38:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101683", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Oracle E-Business Suite: Applications DBA lets a local user take over

Oracle E-Business Suite's Applications DBA component (AD Utilities) has a flaw that lets a low-privileged user who can log on to the host take control of Applications DBA. A successful attack gives full confidentiality, integrity and availability impact on that component.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Oracle E-Business Suite release level in the environment, for example the Applications DBA version reported by the AD Utilities patch level, against the affected range `12.2.3` to `12.2.15`
- Confirm which hosts run Applications DBA and who holds shell or logon access to them

## Fix

- Apply the Oracle Critical Patch Update fix for CVE-2026-101683 to Oracle E-Business Suite Applications DBA (AD Utilities); the exact patch number is unknown from the sources
- Restrict logon access to hosts where Applications DBA runs to administrators only

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101683

## From the sources

Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_