---
id: "CVE-2026-101757"
kind: "vulnerability"
aliases: ["CVE-2026-101757"]
title: "Oracle E-Business Suite: low-privilege user can take over Application Object Library"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["erp", "oracle-ebs", "package", "self-hosted"]
not_affected_if: ["outside-affected-versions"]
published_at: "2026-10-20T22:18:30+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-25T03:08:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101757", "first_seen_at": "2026-10-23T21:57:23+00:00"}]
---

# Oracle E-Business Suite: low-privilege user can take over Application Object Library

Oracle E-Business Suite's Application Object Library component has a flaw in its DB Privileges handling that lets a low-privileged user with logon to the host compromise the component. A successful attack gives the attacker full takeover of confidentiality, integrity and availability for that component.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the installed E-Business Suite release: affected versions are 12.2.3 through 12.2.15 per the NVD entry.
- Check whether your Oracle E-Business Suite instance runs the Application Object Library in one of those releases.

## Fix

- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Application Object Library; the NVD entry does not name the patch number, so unknown.
- Move to a patched release beyond 12.2.15, exact version unknown from the sources.

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101757

## From the sources

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Object Library executes to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_