---
id: "CVE-2026-101700"
kind: "vulnerability"
aliases: ["CVE-2026-101700"]
title: "Oracle E-Business Suite: Application Object Library flaw allows unauthenticated takeover over HTTP"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Oracle E-Business Suite (Application Object Library)", "fixed": ["October 2026 CPU patch"], "affected": ">= 12.2.3, <= 12.2.15", "ecosystem": "vendor"}]
ecosystems: []
tags: ["application-object-library", "http", "oracle-ebs", "package", "self-hosted", "unauthenticated"]
not_affected_if: ["ebs-not-network-reachable", "not-running-ebs", "patched-oct-2026-cpu", "unknown"]
published_at: "2026-10-20T22:18:24+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T03:25:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101700", "first_seen_at": "2026-10-23T21:57:22+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:25:48+00:00"}]
---

# Oracle E-Business Suite: Application Object Library flaw allows unauthenticated takeover over HTTP

Oracle E-Business Suite's Application Object Library (Core component) has a flaw that lets an unauthenticated remote attacker over HTTP compromise the component. Successful exploitation can lead to full takeover of Application Object Library with high confidentiality, integrity and availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle E-Business Suite (Application Object Library) affected >= 12.2.3, <= 12.2.15 fixed October 2026 CPU patch

## How to check

Check your EBS release (12.2.3 to 12.2.15 is affected) and whether the October 2026 CPU patch is applied, using AD/ADOP patch history (ad_bugs / adop -status) for the patch number from Oracle's EBS patch availability document. Also check whether EBS HTTP is reachable from the internet.

## Fix

Apply the October 2026 Oracle E-Business Suite Critical Patch Update (Rapid7 cites Patch 40022426:12.2.0; confirm in Oracle's EBS patch availability document on My Oracle Support). No workaround found.

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101700
- 2026-10-25T03:25:48+00:00 analyst — Oracle Oct 2026 CPU lists EBS 12.2.3-12.2.15 as affected (primary); fixed via CPU patch, patch number 40022426 only from Rapid7 (secondary, unverified); Oracle's MOS patch doc is login-gated and not read. No exploitation or PoC found, not in KEV; AC:H. Nothing marked verified.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [fix] Rapid7 DB: CVE-2026-101700 https://www.rapid7.com/db/vulnerabilities/cve-2026-101700/

## From the sources

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_