{"id":"CVE-2026-101697","kind":"vulnerability","aliases":["CVE-2026-101697"],"related":[],"title":"Oracle E-Business Suite: One-to-One Fulfillment admin console flaw exposes data","description":"Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Admin Console UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle One-to-One Fulfillment, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle One-to-One Fulfillment accessible data as well as  unauthorized read access to a subset of Oracle One-to-One Fulfillment accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","summary":"The Admin Console UI of Oracle One-to-One Fulfillment, part of Oracle E-Business Suite, can be abused over HTTP by an unauthenticated attacker when a logged-in person takes an action. A successful attack lets the attacker read a subset of data and change or delete some data in the product.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["one-to-one-fulfillment","oracle-ebs","self-hosted","vendor"],"not_affected_if":["module-not-installed"],"how_to_check":"- Confirm whether Oracle One-to-One Fulfillment is installed in your E-Business Suite environment and check its version against `12.2.3` through `12.2.15`\n- unknown for other checks, the sources do not say","fix":"- Apply the Oracle Critical Patch Update fix for CVE-2026-101697 to Oracle One-to-One Fulfillment on E-Business Suite; the exact patch number is unknown from the sources","status":"open","published_at":"2026-10-20T22:18:24+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T04:03:48+00:00","updated_at":"2026-10-25T04:03:48+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T04:03:48Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for CVE-2026-101697 to Oracle One-to-One Fulfillment on E-Business Suite; the exact patch number is unknown from the sources","reach":"internet","title":"Oracle E-Business Suite: One-to-One Fulfillment admin console flaw exposes data","impact":"medium","summary":"The Admin Console UI of Oracle One-to-One Fulfillment, part of Oracle E-Business Suite, can be abused over HTTP by an unauthenticated attacker when a logged-in person takes an action. A successful attack lets the attacker read a subset of data and change or delete some data in the product.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","one-to-one-fulfillment","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reads a subset of data and alters or deletes some records","analyst_note":"Check the Oracle Security Alert or CPU advisory for the patch number and whether the Admin Console is internet-reachable by default; source is https://nvd.nist.gov/vuln/detail/CVE-2026-101697","how_to_check":"- Confirm whether Oracle One-to-One Fulfillment is installed in your E-Business Suite environment and check its version against `12.2.3` through `12.2.15`\n- unknown for other checks, the sources do not say","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Teams running Oracle E-Business Suite 12.2 with the One-to-One Fulfillment module in the affected version range, where the Admin Console UI is reachable over HTTP. The attack needs a human other than the attacker to act, so exposure is lower on internal-only deployments. Teams without One-to-One Fulfillment can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000697,"input_tokens":3590,"output_tokens":675,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101697':18A,21A '-2026':17A,20A '/av':225C '12.2.15':117C '12.2.3':116C '3.1':213C,224C '6.1':216C 'abus':54B 'access':126C,182C,192C,199C,210C 'action':69B 'addit':165C 'admin':11A,35B,107C 'affect':114C 'allow':121C 'attack':60B,72B,75B,123C,138C,148C,161C,170C 'base':214C 'busi':4A,50B,104C 'c/c':230C 'chang':82B,168C 'compon':106C 'compromis':130C 'confidenti':217C 'consol':12A,36B,108C 'cve':16A,19A 'cvss':212C,221C,223C 'data':15A,80B,86B,193C,211C 'delet':84B,181C 'e':3A,49B,103C 'e-busi':2A,48B,102C 'easili':118C 'eb':29B 'exploit':119C 'expos':14A 'flaw':13A 'fulfil':10A,26B,44B,98C,136C,160C,191C,209C 'host':32B 'http':56B,128C 'human':140C 'impact':164C,220C 'insert':179C 'integr':219C 'interact':141C 'l/a':232C 'l/i':231C 'l/pr':227C 'let':73B 'log':64B 'logged-in':63B 'may':162C 'n':233C 'n/ac':226C 'n/ui':228C 'network':125C 'one':7A,9A,23B,25B,41B,43B,95C,97C,133C,135C,157C,159C,188C,190C,206C,208C 'one-to-on':6A,40B,94C,132C,156C,187C,205C 'one-to-one-fulfil':22B 'oracl':1A,28B,39B,47B,93C,101C,131C,155C,186C,204C 'oracle-eb':27B 'part':45B 'person':66B,144C 'product':89B,99C,166C 'r/s':229C 'read':76B,198C 'requir':139C 'result':175C 'scope':167C 'score':215C 'self':31B 'self-host':30B 'signific':163C 'subset':78B,202C 'success':71B,137C,169C 'suit':5A,51B,105C 'support':110C 'take':67B 'ui':37B,109C 'unauthent':59B,122C 'unauthor':177C,197C 'updat':178C 'vector':222C 'vendor':33B 'version':111C 'via':127C 'vulner':90C,120C,152C,173C 'well':195C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle E-Business Suite 12.2 with the One-to-One Fulfillment module in the affected version range, where the Admin Console UI is reachable over HTTP. The attack needs a human other than the attacker to act, so exposure is lower on internal-only deployments. Teams without One-to-One Fulfillment can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101697","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101697","severity":null,"published_at":"2026-10-20T22:18:24+00:00","modified_at":"2026-10-22T18:17:14+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}