{"id":"CVE-2026-101815","kind":"vulnerability","aliases":["CVE-2026-101815"],"related":[],"title":"Oracle E-Business Suite Assets: low-privileged HTTP attacker can read, change and crash","description":"Vulnerability in the Assets product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Assets.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Assets as well as  unauthorized update, insert or delete access to some of Assets accessible data and  unauthorized read access to a subset of Assets accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H).","summary":"A flaw in the Assets module of Oracle E-Business Suite's Internal Operations component lets a low-privileged user reach it over HTTP. An attacker can read and modify some Assets data and crash or hang the module.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["assets","erp","on-prem","oracle-ebs","vendor"],"not_affected_if":["assets-module-not-used"],"how_to_check":"- Confirm the Assets module is installed and in use in your Oracle E-Business Suite instance\n- Check the installed release against the affected range `12.2.3` through `12.2.15`\n- unknown for other checks, as the sources do not say","fix":"- Apply the Oracle Critical Patch Update fix for Assets in Oracle E-Business Suite; the sources do not name the patch\n- unknown for a specific target version","status":"open","published_at":"2026-10-20T22:18:37+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T03:14:29+00:00","updated_at":"2026-10-25T03:14:29+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T03:14:29Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Assets in Oracle E-Business Suite; the sources do not name the patch\n- unknown for a specific target version","reach":"internet","title":"Oracle E-Business Suite Assets: low-privileged HTTP attacker can read, change and crash","impact":"high","summary":"A flaw in the Assets module of Oracle E-Business Suite's Internal Operations component lets a low-privileged user reach it over HTTP. An attacker can read and modify some Assets data and crash or hang the module.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","assets","erp","on-prem"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads and changes some Assets data and crashes the module","analyst_note":"Check Oracle's Critical Patch Update advisory for the exact patch and whether the Internal Operations component is internet-facing by default.","how_to_check":"- Confirm the Assets module is installed and in use in your Oracle E-Business Suite instance\n- Check the installed release against the affected range `12.2.3` through `12.2.15`\n- unknown for other checks, as the sources do not say","needs_analyst":true,"not_affected_if":["assets-module-not-used"],"who_is_affected":"Oracle E-Business Suite installations running Assets in the `12.2.3` through `12.2.15` range are affected. Sites that do not run the Assets module, or run releases outside that range, are not in scope according to the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000632,"input_tokens":3501,"output_tokens":563,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101815':19A,22A '-2026':18A,21A '/av':172C '12.2.15':94C '12.2.3':93C '3.1':159C,171C '7.6':162C 'abil':119C 'access':104C,140C,145C,150C,156C 'affect':91C 'allow':98C 'asset':6A,23B,36B,65B,76C,109C,131C,144C,155C 'attack':11A,59B,101C,111C 'avail':166C 'base':160C 'busi':4A,42B,82C 'caus':121C 'chang':14A 'complet':128C 'compon':47B,84C 'compromis':108C 'confidenti':163C 'crash':16A,68B,127C 'cve':17A,20A 'cvss':158C,168C,170C 'data':66B,146C,157C 'delet':139C 'dos':129C 'e':3A,41B,81C 'e-busi':2A,40B,80C 'easili':95C 'eb':30B 'erp':24B 'exploit':96C 'flaw':33B 'frequent':125C 'h':180C 'hang':70B,123C 'http':10A,57B,106C 'impact':167C 'insert':137C 'integr':164C 'intern':45B,85C 'l/a':179C 'l/i':178C 'l/pr':174C 'l/ui':175C 'let':48B 'low':8A,51B,99C 'low-privileg':7A,50B 'modifi':63B 'modul':37B,72B 'n/ac':173C 'n/s':176C 'network':103C 'on-prem':25B 'oper':46B,86C 'oracl':1A,29B,39B,79C 'oracle-eb':28B 'prem':27B 'privileg':9A,52B,100C 'product':77C 'reach':54B 'read':13A,61B,149C 'repeat':126C 'result':116C 'score':161C 'subset':153C 'success':110C 'suit':5A,43B,83C 'support':87C 'u/c':177C 'unauthor':118C,135C,148C 'updat':136C 'user':53B 'vector':169C 'vendor':31B 'version':88C 'via':105C 'vulner':73C,97C,114C 'well':133C","nicknames":[],"mitigations":[],"who_affected":"Oracle E-Business Suite installations running Assets in the `12.2.3` through `12.2.15` range are affected. Sites that do not run the Assets module, or run releases outside that range, are not in scope according to the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101815","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101815","severity":null,"published_at":"2026-10-20T22:18:37+00:00","modified_at":"2026-10-22T18:17:25+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}