---
id: "CVE-2026-101742"
kind: "vulnerability"
aliases: ["CVE-2026-101742"]
title: "Oracle E-Business Suite: Applications Manager Diagnostics flaw allows full takeover"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Oracle E-Business Suite (Applications Manager, Diagnostics)", "fixed": ["Oct 2026 CPU patch 40022426 (per Rapid7, unverified)"], "affected": ">= 12.2.3, <= 12.2.15", "ecosystem": "vendor"}]
ecosystems: []
tags: ["oracle-applications-manager", "oracle-e-business-suite", "other", "self-hosted"]
not_affected_if: ["default-config", "managed-hosting"]
published_at: "2026-10-20T22:18:29+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-24T00:06:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101742", "first_seen_at": "2026-10-23T21:57:23+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:06:19+00:00"}]
---

# Oracle E-Business Suite: Applications Manager Diagnostics flaw allows full takeover

A low-privileged user with network access over HTTP can compromise Oracle Applications Manager in Oracle E-Business Suite 12.2.3 through 12.2.15. A successful attack gives the attacker takeover of the component, with high confidentiality, integrity and availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle E-Business Suite (Applications Manager, Diagnostics) affected >= 12.2.3, <= 12.2.15 fixed Oct 2026 CPU patch 40022426 (per Rapid7, unverified)

## How to check

Find your EBS release (Oracle Applications Manager > Site Map, or select release_name from fnd_product_groups). 12.2.3-12.2.15 is affected. Then check with AD/OPatch tooling (adop -status, or query ad_bugs) whether the Oct 2026 CPU patch (40022426) is applied.

## Fix

Apply the Oracle E-Business Suite patch from the October 2026 Critical Patch Update (Rapid7 cites Patch 40022426 for 12.2.0; confirm in the MOS patch availability document for EBS). No workaround found; until patched, restrict network access to Oracle Applications Manager / Diagnostics URLs and limit low-privileged accounts.

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101742
- 2026-10-24T00:06:19+00:00 analyst — Oracle CPU Oct 2026 (20 Oct) lists E-Business Suite 12.2.3-12.2.15 as affected; fix = apply Oct 2026 CPU EBS patch. Patch number 40022426 comes only from Rapid7 (secondary), not verified on the Oracle MOS patch doc (login needed). No exploitation reported, not in KEV; no PoC or discussion searched/found. Oracle advisory page text was truncated before the EBS risk matrix.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [fix] Rapid7: CVE-2026-101742 (patch 40022426) https://www.rapid7.com/db/vulnerabilities/cve-2026-101742/

## From the sources

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_