{"id":"CVE-2026-101698","kind":"vulnerability","aliases":["CVE-2026-101698"],"related":[],"title":"Oracle E-Business Suite One-to-One Fulfillment: Java server flaw allows takeover","description":"Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Java Server Issues).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment.  Successful attacks of this vulnerability can result in takeover of Oracle One-to-One Fulfillment. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle One-to-One Fulfillment, part of Oracle E-Business Suite, has a flaw in its Java server components that can be reached over HTTP. A low-privileged attacker on the network can, with difficulty, fully compromise the product, per the NVD CVSS 3.1 score of 7.5.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","on-prem-erp","one-to-one-fulfillment","oracle-ebs","vendor"],"not_affected_if":["module-not-deployed","version-outside-range"],"how_to_check":"- Confirm the installed E-Business Suite version and whether One-to-One Fulfillment is in use; the affected range is `12.2.3` through `12.2.15`\n- Check the Oracle Critical Patch Update advisory for the patch level that covers this CVE; exact patch name unknown","fix":"- Apply the Oracle Critical Patch Update that addresses CVE-2026-101698 for Oracle E-Business Suite 12.2; exact patch name unknown\n- Restrict HTTP access to the One-to-One Fulfillment server to trusted networks until patched","status":"open","published_at":"2026-10-20T22:18:24+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:19:12+00:00","updated_at":"2026-10-25T03:19:12+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:19:12Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update that addresses CVE-2026-101698 for Oracle E-Business Suite 12.2; exact patch name unknown\n- Restrict HTTP access to the One-to-One Fulfillment server to trusted networks until patched","reach":"network","title":"Oracle E-Business Suite One-to-One Fulfillment: Java server flaw allows takeover","impact":"high","summary":"Oracle One-to-One Fulfillment, part of Oracle E-Business Suite, has a flaw in its Java server components that can be reached over HTTP. A low-privileged attacker on the network can, with difficulty, fully compromise the product, per the NVD CVSS 3.1 score of 7.5.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","one-to-one-fulfillment","java","on-prem-erp"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over the One-to-One Fulfillment server over HTTP","analyst_note":"Find the Oracle CPU advisory and patch name for CVE-2026-101698, and confirm how_to_check details from Oracle's advisory, which the NVD entry does not give.","how_to_check":"- Confirm the installed E-Business Suite version and whether One-to-One Fulfillment is in use; the affected range is `12.2.3` through `12.2.15`\n- Check the Oracle Critical Patch Update advisory for the patch level that covers this CVE; exact patch name unknown","needs_analyst":true,"not_affected_if":["version-outside-range","module-not-deployed"],"who_is_affected":"Oracle E-Business Suite installations running One-to-One Fulfillment in the affected 12.2 range, where the HTTP interface is reachable by low-privileged users. Systems without One-to-One Fulfillment deployed, or outside the listed versions, are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000697,"input_tokens":3477,"output_tokens":698,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101698':18A,21A '-2026':17A,20A '/av':165C '12.2.15':113C '12.2.3':112C '3.1':82B,152C,164C '7.5':85B,155C 'access':124C 'affect':110C 'allow':14A,118C 'attack':67B,121C,136C 'avail':159C 'base':153C 'busi':4A,47B,100C 'compon':56B,102C 'compromis':75B,128C 'confidenti':156C 'cve':16A,19A 'cvss':81B,151C,161C,163C 'difficult':114C 'difficulti':73B 'e':3A,46B,99C 'e-busi':2A,45B,98C 'eb':34B 'erp':26B 'exploit':116C 'flaw':13A,51B 'fulfil':10A,31B,41B,94C,134C,150C 'fulli':74B 'h':173C 'h/a':172C 'h/i':171C 'h/pr':167C 'http':62B,126C 'impact':160C 'integr':157C 'issu':105C 'java':11A,22B,54B,103C 'l/ui':168C 'low':65B,119C 'low-privileg':64B 'n/ac':166C 'n/s':169C 'network':70B,123C 'nvd':80B 'on-prem-erp':23B 'one':7A,9A,28B,30B,38B,40B,91C,93C,131C,133C,147C,149C 'one-to-on':6A,37B,90C,130C,146C 'one-to-one-fulfil':27B 'oracl':1A,33B,36B,44B,89C,97C,129C,145C 'oracle-eb':32B 'part':42B 'per':78B 'prem':25B 'privileg':66B,120C 'product':77B,95C 'reach':60B 'result':141C 'score':83B,154C 'server':12A,55B,104C 'success':135C 'suit':5A,48B,101C 'support':106C 'takeov':15A,143C 'u/c':170C 'vector':162C 'vendor':35B 'version':107C 'via':125C 'vulner':86C,117C,139C","nicknames":[],"mitigations":[],"who_affected":"Oracle E-Business Suite installations running One-to-One Fulfillment in the affected 12.2 range, where the HTTP interface is reachable by low-privileged users. Systems without One-to-One Fulfillment deployed, or outside the listed versions, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101698","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101698","severity":null,"published_at":"2026-10-20T22:18:24+00:00","modified_at":"2026-10-22T16:17:12+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}