{"id":"CVE-2026-101742","kind":"vulnerability","aliases":["CVE-2026-101742"],"related":[],"title":"Oracle E-Business Suite: Applications Manager Diagnostics flaw allows full takeover","description":"Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"A low-privileged user with network access over HTTP can compromise Oracle Applications Manager in Oracle E-Business Suite 12.2.3 through 12.2.15. A successful attack gives the attacker takeover of the component, with high confidentiality, integrity and availability impact.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle E-Business Suite (Applications Manager, Diagnostics)","fixed":["Oct 2026 CPU patch 40022426 (per Rapid7, unverified)"],"affected":">= 12.2.3, <= 12.2.15","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle-applications-manager","oracle-e-business-suite","other","self-hosted"],"not_affected_if":["default-config","managed-hosting"],"how_to_check":"Find your EBS release (Oracle Applications Manager > Site Map, or select release_name from fnd_product_groups). 12.2.3-12.2.15 is affected. Then check with AD/OPatch tooling (adop -status, or query ad_bugs) whether the Oct 2026 CPU patch (40022426) is applied.","fix":"Apply the Oracle E-Business Suite patch from the October 2026 Critical Patch Update (Rapid7 cites Patch 40022426 for 12.2.0; confirm in the MOS patch availability document for EBS). No workaround found; until patched, restrict network access to Oracle Applications Manager / Diagnostics URLs and limit low-privileged accounts.","status":"open","published_at":"2026-10-20T22:18:29+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-23T22:38:42+00:00","updated_at":"2026-10-24T00:06:19+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-23T22:38:42Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Oracle Critical Patch Update fix for the affected release; the patch identifier is not stated in the sources.\nunknown","reach":"network","title":"Oracle E-Business Suite: Applications Manager Diagnostics flaw allows full takeover","impact":"high","summary":"A low-privileged user with network access over HTTP can compromise Oracle Applications Manager in Oracle E-Business Suite 12.2.3 through 12.2.15. A successful attack gives the attacker takeover of the component, with high confidentiality, integrity and availability impact.","category":"other","who_cares":["oracle-e-business-suite","oracle-applications-manager","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker takes over Oracle Applications Manager, reading and changing data.","analyst_note":"Find the Oracle Critical Patch Update advisory for CVE-2026-101742 and the exact patch number for 12.2.3-12.2.15; the NVD entry does not give one.","how_to_check":"Check the installed E-Business Suite release level against 12.2.3-12.2.15 in the Oracle Applications Manager environment.\nunknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000545,"input_tokens":3075,"output_tokens":474,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the patch or workaround in Oracle's Critical Patch Update advisory for this CVE and confirm the fixed release; sources give no fix.","search":"'-101742':15A,18A '-2026':14A,17A '/av':148C '12.2.15':63B,103C '12.2.3':61B,102C '3.1':135C,147C '8.8':138C 'access':47B,113C 'affect':100C 'allow':10A,107C 'applic':6A,29B,53B,85C,119C,132C 'applications':24A 'attack':66B,69B,110C,122C 'avail':79B,142C 'base':136C 'busi':4A,34B,59B,92C 'business':22A 'compon':73B,94C 'compromis':51B,117C 'confidenti':76B,139C 'cve':13A,16A 'cvss':134C,144C,146C 'diagnost':8A,95C 'diagnostics':26A 'e':3A,21A,33B,58B,91C 'e-busi':2A,57B,90C 'e-business':20A 'easili':104C 'exploit':105C 'flaw':9A 'full':11A 'give':67B 'h':156C 'h/a':155C 'h/i':154C 'high':75B 'host':39B 'http':49B,115C 'impact':80B,143C 'integr':77B,140C 'l/pr':150C 'l/ui':151C 'low':42B,108C 'low-privileg':41B 'manag':7A,30B,54B,86C,120C,133C 'manager':25A 'n/ac':149C 'n/s':152C 'network':46B,112C 'oracl':1A,28B,32B,52B,56B,84C,89C,118C,131C 'oracle':19A 'oracle-applications-manag':27B 'oracle-e-business-suit':31B 'privileg':43B,109C 'product':87C 'result':127C 'score':137C 'self':38B 'self-host':37B 'success':65B,121C 'suit':5A,35B,60B,93C 'suite':23A 'support':96C 'takeov':12A,70B,129C 'u/c':153C 'user':44B 'vector':145C 'version':97C 'via':114C 'vulner':81C,106C,125C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101742","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101742","severity":null,"published_at":"2026-10-20T22:18:29+00:00","modified_at":"2026-10-22T16:17:14+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101742:586","url":null,"severity":null,"published_at":"2026-10-24T00:06:19+00:00","modified_at":"2026-10-24T00:06:19+00:00","first_seen_at":"2026-10-24T00:06:19+00:00","fetched_at":"2026-10-24T00:06:19+00:00","note":"Oracle CPU Oct 2026 (20 Oct) lists E-Business Suite 12.2.3-12.2.15 as affected; fix = apply Oct 2026 CPU EBS patch. Patch number 40022426 comes only from Rapid7 (secondary), not verified on the Oracle MOS patch doc (login needed). No exploitation reported, not in KEV; no PoC or discussion searched/found. Oracle advisory page text was truncated before the EBS risk matrix."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2354,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-101742/","title":"Rapid7: CVE-2026-101742 (patch 40022426)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}