{"id":"CVE-2026-101700","kind":"vulnerability","aliases":["CVE-2026-101700"],"related":[],"title":"Oracle E-Business Suite: Application Object Library flaw allows unauthenticated takeover over HTTP","description":"Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle E-Business Suite's Application Object Library (Core component) has a flaw that lets an unauthenticated remote attacker over HTTP compromise the component. Successful exploitation can lead to full takeover of Application Object Library with high confidentiality, integrity and availability impact.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle E-Business Suite (Application Object Library)","fixed":["October 2026 CPU patch"],"affected":">= 12.2.3, <= 12.2.15","ecosystem":"vendor"}],"ecosystems":[],"tags":["application-object-library","http","oracle-ebs","package","self-hosted","unauthenticated"],"not_affected_if":["ebs-not-network-reachable","not-running-ebs","patched-oct-2026-cpu","unknown"],"how_to_check":"Check your EBS release (12.2.3 to 12.2.15 is affected) and whether the October 2026 CPU patch is applied, using AD/ADOP patch history (ad_bugs / adop -status) for the patch number from Oracle's EBS patch availability document. Also check whether EBS HTTP is reachable from the internet.","fix":"Apply the October 2026 Oracle E-Business Suite Critical Patch Update (Rapid7 cites Patch 40022426:12.2.0; confirm in Oracle's EBS patch availability document on My Oracle Support). No workaround found.","status":"open","published_at":"2026-10-20T22:18:24+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:06:22+00:00","updated_at":"2026-10-25T03:25:48+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:06:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Oracle E-Business Suite: Application Object Library flaw allows unauthenticated takeover over HTTP","impact":"high","summary":"Oracle E-Business Suite's Application Object Library (Core component) has a flaw that lets an unauthenticated remote attacker over HTTP compromise the component. Successful exploitation can lead to full takeover of Application Object Library with high confidentiality, integrity and availability impact.","category":"package","nicknames":[],"who_cares":["oracle-ebs","application-object-library","self-hosted","http"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker takes over Application Object Library, reading and altering data.","analyst_note":"Check Oracle Critical Patch Update advisory for the patch level fixing 12.2.3-12.2.15 and any workaround; the NVD entry gives no fix or check details.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running Oracle E-Business Suite with Application Object Library in the supported versions 12.2.3 through 12.2.15 are affected. Exposure depends on whether the EBS HTTP interface is reachable from the network, which the sources do not detail. Teams not running Oracle E-Business Suite in those versions can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000599,"input_tokens":3449,"output_tokens":509,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Oracle Critical Patch Update advisory for the patch level fixing 12.2.3-12.2.15 and any workaround; the NVD entry gives no fix or check details.","search":"'-101700':17A,20A '-2026':16A,19A '/av':155C '12.2.15':108C '12.2.3':107C '3.1':142C,154C '8.1':145C 'access':118C 'affect':105C 'allow':10A,113C 'applic':6A,30B,48B,75B,89C,124C,138C 'application':26A 'application-object-librari':29B 'attack':61B,115C,128C 'avail':83B,149C 'base':143C 'busi':4A,45B,97C 'business':24A 'compon':52B,66B,99C 'compromis':64B,122C 'confidenti':80B,146C 'core':51B,100C 'cve':15A,18A 'cvss':141C,151C,153C 'difficult':109C 'e':3A,23A,44B,96C 'e-busi':2A,43B,95C 'e-business':22A 'eb':36B 'exploit':68B,111C 'flaw':9A,55B 'full':72B 'h':163C 'h/a':162C 'h/i':161C 'h/pr':157C 'high':79B 'host':40B 'http':14A,33B,63B,120C 'impact':84B,150C 'integr':81B,147C 'lead':70B 'let':57B 'librari':8A,32B,50B,77B,91C,126C,140C 'library':28A 'n/ac':156C 'n/s':159C 'n/ui':158C 'network':117C 'object':7A,27A,31B,49B,76B,90C,125C,139C 'oracl':1A,35B,42B,88C,94C,123C,137C 'oracle':21A 'oracle-eb':34B 'packag':37B 'product':92C 'remot':60B 'result':133C 'score':144C 'self':39B 'self-host':38B 'success':67B,127C 'suit':5A,46B,98C 'suite':25A 'support':101C 'takeov':12A,73B,135C 'u/c':160C 'unauthent':11A,41B,59B,114C 'vector':152C 'version':102C 'via':119C 'vulner':85C,112C,131C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite with Application Object Library in the supported versions 12.2.3 through 12.2.15 are affected. Exposure depends on whether the EBS HTTP interface is reachable from the network, which the sources do not detail. Teams not running Oracle E-Business Suite in those versions can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101700","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101700","severity":null,"published_at":"2026-10-20T22:18:24+00:00","modified_at":"2026-10-22T16:17:12+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101700:714","url":null,"severity":null,"published_at":"2026-10-25T03:25:48+00:00","modified_at":"2026-10-25T03:25:48+00:00","first_seen_at":"2026-10-25T03:25:48+00:00","fetched_at":"2026-10-25T03:25:48+00:00","note":"Oracle Oct 2026 CPU lists EBS 12.2.3-12.2.15 as affected (primary); fixed via CPU patch, patch number 40022426 only from Rapid7 (secondary, unverified); Oracle's MOS patch doc is login-gated and not read. No exploitation or PoC found, not in KEV; AC:H. Nothing marked verified."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3163,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-101700/","title":"Rapid7 DB: CVE-2026-101700","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}