{"id":"CVE-2026-101813","kind":"vulnerability","aliases":["CVE-2026-101813"],"related":[],"title":"Oracle E-Business Suite Change Management: low-privilege network takeover of Engineering","description":"Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Engineering.  Successful attacks of this vulnerability can result in takeover of Oracle Engineering. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle E-Business Suite's Engineering product, in its Change Management component, has a flaw reachable over HTTP. An attacker with a low-privilege account can take over the Engineering product, with full confidentiality, integrity and availability impact.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle E-Business Suite (Engineering, Change Management)","fixed":["October 2026 CPU patch (number unknown)"],"affected":">= 12.2.3, <= 12.2.15","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle-e-business-suite","oracle-engineering","package","self-hosted"],"not_affected_if":["managed-hosting","unknown"],"how_to_check":"Check whether you run Oracle E-Business Suite 12.2.3-12.2.15 with Oracle Engineering (Change Management component) installed. Then check whether the October 2026 CPU patch is applied, using the patch list in MOS KA923 and the AD/ADOP patch history (ad_bugs / adop -status).","fix":"Apply the Oracle E-Business Suite October 2026 Critical Patch Update (released 2026-10-20). Find the Engineering patch number through MOS article KA923 and the EBS patch availability document linked from the CPU advisory. The exact patch number is unknown because it sits behind My Oracle Support login.","status":"open","published_at":"2026-10-20T22:18:37+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-23T22:38:36+00:00","updated_at":"2026-10-24T00:06:08+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:38:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle E-Business Suite Change Management: low-privilege network takeover of Engineering","impact":"high","summary":"Oracle E-Business Suite's Engineering product, in its Change Management component, has a flaw reachable over HTTP. An attacker with a low-privilege account can take over the Engineering product, with full confidentiality, integrity and availability impact.","category":"package","who_cares":["oracle-e-business-suite","oracle-engineering"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker takes over Engineering, reading and changing all its data","analyst_note":"Find the Oracle Critical Patch Update advisory for this CVE to get the patch level and check steps; the sources give no fix or check procedure.","how_to_check":"Check the installed Oracle E-Business Suite release; sources list 12.2.3 through 12.2.15 as affected.","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000496,"input_tokens":3055,"output_tokens":380,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Oracle Critical Patch Update advisory for this CVE to get the patch level and check steps; the sources give no fix or check procedure.","search":"'-101813':17A,20A '-2026':16A,19A '/av':146C '12.2.15':103C '12.2.3':102C '3.1':133C,145C '8.8':136C 'access':113C 'account':67B 'affect':100C 'allow':107C 'attack':61B,110C,121C 'avail':79B,140C 'base':134C 'busi':4A,32B,44B,91C 'business':24A 'chang':6A,51B,94C 'change':27A 'compon':53B,93C 'compromis':117C 'confidenti':76B,137C 'cve':15A,18A 'cvss':132C,142C,144C 'e':3A,23A,31B,43B,90C 'e-busi':2A,42B,89C 'e-business':22A 'easili':104C 'engin':14A,36B,47B,72B,85C,119C,131C 'engineering':26A 'exploit':105C 'flaw':56B 'full':75B 'h':154C 'h/a':153C 'h/i':152C 'host':40B 'http':59B,115C 'impact':80B,141C 'integr':77B,138C 'l/pr':148C 'l/ui':149C 'low':9A,65B,108C 'low-privileg':8A,64B 'manag':7A,52B,95C 'management':28A 'n/ac':147C 'n/s':150C 'network':11A,112C 'oracl':1A,30B,35B,41B,84C,88C,118C,130C 'oracle':21A 'oracle-e-business-suit':29B 'oracle-engin':34B 'packag':37B 'privileg':10A,66B,109C 'product':48B,73B,86C 'reachabl':57B 'result':126C 'score':135C 'self':39B 'self-host':38B 'success':120C 'suit':5A,33B,45B,92C 'suite':25A 'support':96C 'take':69B 'takeov':12A,128C 'u/c':151C 'vector':143C 'version':97C 'via':114C 'vulner':81C,106C,124C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101813","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101813","severity":null,"published_at":"2026-10-20T22:18:37+00:00","modified_at":"2026-10-22T16:17:18+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101813:585","url":null,"severity":null,"published_at":"2026-10-24T00:06:08+00:00","modified_at":"2026-10-24T00:06:08+00:00","first_seen_at":"2026-10-24T00:06:08+00:00","fetched_at":"2026-10-24T00:06:08+00:00","note":"Oracle CPU Oct 2026 lists EBS 12.2.3-12.2.15 as affected; fix is the October 2026 EBS CPU patch via MOS KA923. The exact patch number is in a MOS doc I could not read. No exploitation or PoC found; social search not run."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2337,"url":"https://blogs.oracle.com/ebstech/critical-patch-update-for-october-2026-now-available","title":"Critical Patch Update for October 2026 Now Available (EBS)","kind":"vendor","source":"analyst","text":"EBS CSPU/CPU for October 2026 released 20 Oct 2026. Oracle strongly recommends applying without delay. Latest EBS CPU doc is found via MOS KA923.","published_at":null,"relation":"fix","confidence":null,"note":null},{"id":2350,"url":"https://cve.armis.com/CVE-2026-101813","title":"Armis CVE-2026-101813","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}