{"id":"CVE-2026-101706","kind":"vulnerability","aliases":["CVE-2026-101706"],"related":[],"title":"Oracle E-Business Suite One-to-One Fulfillment: low-privilege HTTP flaw exposes data","description":"Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle One-to-One Fulfillment accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","summary":"Oracle E-Business Suite's One-to-One Fulfillment component, in its Documents area, has a flaw that an authenticated low-privilege user can reach over HTTP. A successful attack gives read access to critical data the product can reach.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise-erp","one-to-one-fulfillment","oracle-ebs","package","self-hosted"],"not_affected_if":["not-installed","outside-listed-versions"],"how_to_check":"- Confirm the Oracle E-Business Suite release in use, such as `12.2.3` through `12.2.15`, and whether One-to-One Fulfillment is installed\n- Check the Oracle Critical Patch Update advisory for the patch level that covers this CVE: unknown","fix":"- Apply the Oracle Critical Patch Update fix for CVE-2026-101706 to the affected Oracle E-Business Suite 12.2.x release: unknown exact patch\n- Move to a supported release outside `12.2.3` through `12.2.15` if the vendor patch is not available: unknown","status":"open","published_at":"2026-10-20T22:18:25+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:55:03+00:00","updated_at":"2026-10-25T03:55:03+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:55:03Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for CVE-2026-101706 to the affected Oracle E-Business Suite 12.2.x release: unknown exact patch\n- Move to a supported release outside `12.2.3` through `12.2.15` if the vendor patch is not available: unknown","reach":"network","title":"Oracle E-Business Suite One-to-One Fulfillment: low-privilege HTTP flaw exposes data","impact":"medium","summary":"Oracle E-Business Suite's One-to-One Fulfillment component, in its Documents area, has a flaw that an authenticated low-privilege user can reach over HTTP. A successful attack gives read access to critical data the product can reach.","category":"package","nicknames":[],"who_cares":["oracle-ebs","one-to-one-fulfillment","self-hosted","enterprise-erp"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads critical One-to-One Fulfillment data as a low-privilege user","analyst_note":"Find the Oracle Critical Patch Update advisory and the patch name for CVE-2026-101706 to confirm the fix and whether One-to-One Fulfillment is in default install.","how_to_check":"- Confirm the Oracle E-Business Suite release in use, such as `12.2.3` through `12.2.15`, and whether One-to-One Fulfillment is installed\n- Check the Oracle Critical Patch Update advisory for the patch level that covers this CVE: unknown","needs_analyst":true,"not_affected_if":["not-installed","outside-listed-versions"],"who_is_affected":"Sites running Oracle E-Business Suite 12.2.3 through 12.2.15 with One-to-One Fulfillment enabled are in scope. The attacker needs a low-privilege account and network access to the HTTP interface. Sites without One-to-One Fulfillment, or outside the listed versions, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000702,"input_tokens":3477,"output_tokens":709,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101706':20A,23A '-2026':19A,22A '/av':165C '12.2.15':107C '12.2.3':106C '3.1':155C,164C '6.5':158C 'access':74B,117C,137C,143C,152C 'affect':104C 'allow':111C 'area':54B 'attack':71B,114C,129C 'authent':60B 'base':156C 'busi':4A,42B,96C 'complet':142C 'compon':50B,98C 'compromis':121C 'confidenti':159C 'critic':76B,139C 'cve':18A,21A 'cvss':154C,161C,163C 'data':17A,77B,140C,153C 'document':53B,99C 'e':3A,41B,95C 'e-busi':2A,40B,94C 'easili':108C 'eb':34B 'enterpris':25B 'enterprise-erp':24B 'erp':26B 'exploit':109C 'expos':16A 'flaw':15A,57B 'fulfil':10A,31B,49B,90C,127C,151C 'give':72B 'h/i':171C 'host':38B 'http':14A,68B,119C 'impact':160C 'l/pr':167C 'l/ui':168C 'low':12A,62B,112C 'low-privileg':11A,61B 'n':173C 'n/a':172C 'n/ac':166C 'n/s':169C 'network':116C 'one':7A,9A,28B,30B,46B,48B,87C,89C,124C,126C,148C,150C 'one-to-on':6A,45B,86C,123C,147C 'one-to-one-fulfil':27B 'oracl':1A,33B,39B,85C,93C,122C,146C 'oracle-eb':32B 'packag':35B 'privileg':13A,63B,113C 'product':79B,91C 'reach':66B,81B 'read':73B 'result':134C 'score':157C 'self':37B 'self-host':36B 'success':70B,128C 'suit':5A,43B,97C 'support':100C 'u/c':170C 'unauthor':136C 'user':64B 'vector':162C 'version':101C 'via':118C 'vulner':82C,110C,132C","nicknames":[],"mitigations":[],"who_affected":"Sites running Oracle E-Business Suite 12.2.3 through 12.2.15 with One-to-One Fulfillment enabled are in scope. The attacker needs a low-privilege account and network access to the HTTP interface. Sites without One-to-One Fulfillment, or outside the listed versions, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101706","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101706","severity":null,"published_at":"2026-10-20T22:18:25+00:00","modified_at":"2026-10-22T18:17:15+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}