{"id":"CVE-2026-101757","kind":"vulnerability","aliases":["CVE-2026-101757"],"related":[],"title":"Oracle E-Business Suite: low-privilege user can take over Application Object Library","description":"Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Object Library executes to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle E-Business Suite's Application Object Library component has a flaw in its DB Privileges handling that lets a low-privileged user with logon to the host compromise the component. A successful attack gives the attacker full takeover of confidentiality, integrity and availability for that component.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erp","oracle-ebs","package","self-hosted"],"not_affected_if":["outside-affected-versions"],"how_to_check":"- Confirm the installed E-Business Suite release: affected versions are 12.2.3 through 12.2.15 per the NVD entry.\n- Check whether your Oracle E-Business Suite instance runs the Application Object Library in one of those releases.","fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Application Object Library; the NVD entry does not name the patch number, so unknown.\n- Move to a patched release beyond 12.2.15, exact version unknown from the sources.","status":"open","published_at":"2026-10-20T22:18:30+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T03:08:53+00:00","updated_at":"2026-10-25T03:08:53+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:08:53Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Application Object Library; the NVD entry does not name the patch number, so unknown.\n- Move to a patched release beyond 12.2.15, exact version unknown from the sources.","reach":"local","title":"Oracle E-Business Suite: low-privilege user can take over Application Object Library","impact":"high","summary":"Oracle E-Business Suite's Application Object Library component has a flaw in its DB Privileges handling that lets a low-privileged user with logon to the host compromise the component. A successful attack gives the attacker full takeover of confidentiality, integrity and availability for that component.","category":"package","nicknames":[],"who_cares":["oracle-ebs","self-hosted","erp"],"confidence":0.6,"needs_auth":"yes","worst_case":"low-privileged logged-on user takes over the Application Object Library","analyst_note":"Check Oracle's Critical Patch Update advisory for the patch numbers and exact fixed release for E-Business Suite 12.2.x, since the NVD entry does not give them.","how_to_check":"- Confirm the installed E-Business Suite release: affected versions are 12.2.3 through 12.2.15 per the NVD entry.\n- Check whether your Oracle E-Business Suite instance runs the Application Object Library in one of those releases.","needs_analyst":true,"not_affected_if":["outside-affected-versions"],"who_is_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 where users have logon access to the servers hosting Application Object Library. Systems outside those release lines, or where no one without administrative access can log on to the application host, have a smaller exposure but should still be patched.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000666,"input_tokens":3469,"output_tokens":639,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101757':18A,21A '-2026':17A,20A '/av':156C '12.2.15':103C '12.2.3':102C '3.1':143C,155C '7.8':146C 'affect':100C 'allow':107C 'applic':13A,36B,83C,118C,125C,139C 'attack':65B,68B,110C,129C 'avail':75B,150C 'base':144C 'busi':4A,33B,91C 'compon':39B,62B,78B,93C 'compromis':60B,123C 'confidenti':72B,147C 'cve':16A,19A 'cvss':142C,152C,154C 'db':45B,94C 'e':3A,32B,90C 'e-busi':2A,31B,89C 'easili':104C 'eb':25B 'erp':22B 'execut':121C 'exploit':105C 'flaw':42B 'full':69B 'give':66B 'h':164C 'h/a':163C 'h/i':162C 'handl':47B 'host':29B,59B 'impact':151C 'infrastructur':115C 'integr':73B,148C 'l/ac':157C 'l/pr':158C 'l/ui':159C 'let':49B 'librari':15A,38B,85C,120C,127C,141C 'logon':56B,112C 'low':7A,52B,108C 'low-privileg':6A,51B 'n/s':160C 'object':14A,37B,84C,119C,126C,140C 'oracl':1A,24B,30B,82C,88C,117C,124C,138C 'oracle-eb':23B 'packag':26B 'privileg':8A,46B,53B,95C,109C 'product':86C 'result':134C 'score':145C 'self':28B 'self-host':27B 'success':64B,128C 'suit':5A,34B,92C 'support':96C 'take':11A 'takeov':70B,136C 'u/c':161C 'user':9A,54B 'vector':153C 'version':97C 'vulner':79C,106C,132C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 where users have logon access to the servers hosting Application Object Library. Systems outside those release lines, or where no one without administrative access can log on to the application host, have a smaller exposure but should still be patched.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101757","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101757","severity":null,"published_at":"2026-10-20T22:18:30+00:00","modified_at":"2026-10-22T16:17:15+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}