{"id":"CVE-2026-101814","kind":"vulnerability","aliases":["CVE-2026-101814"],"related":[],"title":"Oracle E-Business Suite Change Management: unauthenticated read of some data","description":"Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Engineering.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Engineering accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","summary":"Oracle E-Business Suite's Engineering product, in the Change Management component, has a flaw reachable over HTTP without logging in. An unauthenticated attacker can read a subset of the data that Oracle Engineering can access.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise-apps","oracle-ebs","package"],"not_affected_if":["unaffected-release"],"how_to_check":"- Confirm the installed release is in the 12.2.3 to 12.2.15 range listed as affected, using the Oracle E-Business Suite release information in the environment\n- unknown","fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Change Management, or move to a release outside 12.2.3 to 12.2.15\n- unknown","status":"open","published_at":"2026-10-20T22:18:37+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T04:23:05+00:00","updated_at":"2026-10-25T04:23:05+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:23:05Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Change Management, or move to a release outside 12.2.3 to 12.2.15\n- unknown","reach":"internet","title":"Oracle E-Business Suite Change Management: unauthenticated read of some data","impact":"low","summary":"Oracle E-Business Suite's Engineering product, in the Change Management component, has a flaw reachable over HTTP without logging in. An unauthenticated attacker can read a subset of the data that Oracle Engineering can access.","category":"package","nicknames":[],"who_cares":["oracle-ebs","enterprise-apps"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads a subset of Engineering data without credentials","analyst_note":"","how_to_check":"- Confirm the installed release is in the 12.2.3 to 12.2.15 range listed as affected, using the Oracle E-Business Suite release information in the environment\n- unknown","needs_analyst":false,"not_affected_if":["unaffected-release"],"who_is_affected":"Organisations running Oracle E-Business Suite with the Engineering product and Change Management component in the affected 12.2.3 to 12.2.15 versions, where the HTTP endpoint is reachable from the network. Installations not running that release or component can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000597,"input_tokens":3449,"output_tokens":504,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101814':15A,18A '-2026':14A,17A '/av':131C '12.2.15':85C '12.2.3':84C '3.1':121C,130C '5.3':124C 'access':62B,94C,111C,118C 'affect':82C 'allow':89C 'app':21B 'attack':50B,91C,102C 'base':122C 'busi':4A,29B,73C 'chang':6A,36B,76C 'compon':38B,75C 'compromis':98C 'confidenti':125C 'cve':13A,16A 'cvss':120C,127C,129C 'data':12A,57B,119C 'e':3A,28B,72C 'e-busi':2A,27B,71C 'easili':86C 'eb':24B 'engin':32B,60B,67C,100C,117C 'enterpris':20B 'enterprise-app':19B 'exploit':87C 'flaw':41B 'http':44B,96C 'impact':126C 'l/i':137C 'l/pr':133C 'log':46B 'manag':7A,37B,77C 'n':139C 'n/a':138C 'n/ac':132C 'n/s':135C 'n/ui':134C 'network':93C 'oracl':1A,23B,26B,59B,66C,70C,99C,116C 'oracle-eb':22B 'packag':25B 'product':33B,68C 'reachabl':42B 'read':9A,52B,110C 'result':107C 'score':123C 'subset':54B,114C 'success':101C 'suit':5A,30B,74C 'support':78C 'u/c':136C 'unauthent':8A,49B,90C 'unauthor':109C 'vector':128C 'version':79C 'via':95C 'vulner':63C,88C,105C 'without':45B","nicknames":[],"mitigations":[],"who_affected":"Organisations running Oracle E-Business Suite with the Engineering product and Change Management component in the affected 12.2.3 to 12.2.15 versions, where the HTTP endpoint is reachable from the network. Installations not running that release or component can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101814","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101814","severity":null,"published_at":"2026-10-20T22:18:37+00:00","modified_at":"2026-10-22T16:17:18+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}