{"id":"CVE-2026-101820","kind":"vulnerability","aliases":["CVE-2026-101820"],"related":[],"title":"Oracle E-Business Suite General Ledger: low-privilege network attack allows full takeover","description":"Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: ADADMIN).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle General Ledger.  Successful attacks of this vulnerability can result in takeover of Oracle General Ledger. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle E-Business Suite's General Ledger module, in the ADADMIN component, has a flaw in supported versions 12.2.3 through 12.2.15. A low-privileged user with network access over HTTP can, with difficulty, take over the General Ledger application, per NVD's CVSS 7.5 vector.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erp","general-ledger","oracle-ebs","self-hosted","vendor"],"not_affected_if":["other-release"],"how_to_check":"- Confirm the Oracle E-Business Suite release in use is within `12.2.3` to `12.2.15`\n- Check whether General Ledger is installed and reachable over HTTP from the network\n- unknown for any other check, the sources do not say","fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite General Ledger (the sources do not name the patch or target version)\n- unknown for the specific patch number","status":"open","published_at":"2026-10-20T22:18:37+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T03:19:02+00:00","updated_at":"2026-10-25T03:19:02+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:19:02Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite General Ledger (the sources do not name the patch or target version)\n- unknown for the specific patch number","reach":"network","title":"Oracle E-Business Suite General Ledger: low-privilege network attack allows full takeover","impact":"high","summary":"Oracle E-Business Suite's General Ledger module, in the ADADMIN component, has a flaw in supported versions 12.2.3 through 12.2.15. A low-privileged user with network access over HTTP can, with difficulty, take over the General Ledger application, per NVD's CVSS 7.5 vector.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","general-ledger","erp","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker takes over the General Ledger application","analyst_note":"Find Oracle's Critical Patch Update advisory for this CVE and the patch that fixes ADADMIN in EBS 12.2.3 to 12.2.15; the NVD entry gives no fix or check details.","how_to_check":"- Confirm the Oracle E-Business Suite release in use is within `12.2.3` to `12.2.15`\n- Check whether General Ledger is installed and reachable over HTTP from the network\n- unknown for any other check, the sources do not say","needs_analyst":true,"not_affected_if":["other-release"],"who_is_affected":"Organisations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the General Ledger module reachable over HTTP. Sites not running that release or module, or with no network path for low-privileged users, are less exposed; the sources do not give further detail.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000663,"input_tokens":3451,"output_tokens":635,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101820':18A,21A '-2026':17A,20A '/av':148C '12.2.15':54B,102C '12.2.3':52B,101C '3.1':135C,147C '7.5':78B,138C 'access':62B,113C 'adadmin':44B,94C 'affect':99C 'allow':13A,107C 'applic':73B 'attack':12A,110C,122C 'avail':142C 'base':136C 'busi':4A,36B,91C 'compon':45B,93C 'compromis':117C 'confidenti':139C 'cve':16A,19A 'cvss':77B,134C,144C,146C 'difficult':103C 'difficulti':67B 'e':3A,35B,90C 'e-busi':2A,34B,89C 'eb':28B 'erp':22B 'exploit':105C 'flaw':48B 'full':14A 'general':6A,24B,39B,71B,84C,119C,132C 'general-ledg':23B 'h':156C 'h/a':155C 'h/i':154C 'h/pr':150C 'host':31B 'http':64B,115C 'impact':143C 'integr':140C 'l/ui':151C 'ledger':7A,25B,40B,72B,85C,120C,133C 'low':9A,57B,108C 'low-privileg':8A,56B 'modul':41B 'n/ac':149C 'n/s':152C 'network':11A,61B,112C 'nvd':75B 'oracl':1A,27B,33B,83C,88C,118C,131C 'oracle-eb':26B 'per':74B 'privileg':10A,58B,109C 'product':86C 'result':127C 'score':137C 'self':30B 'self-host':29B 'success':121C 'suit':5A,37B,92C 'support':50B,95C 'take':68B 'takeov':15A,129C 'u/c':153C 'user':59B 'vector':79B,145C 'vendor':32B 'version':51B,96C 'via':114C 'vulner':80C,106C,125C","nicknames":[],"mitigations":[],"who_affected":"Organisations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the General Ledger module reachable over HTTP. Sites not running that release or module, or with no network path for low-privileged users, are less exposed; the sources do not give further detail.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101820","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101820","severity":null,"published_at":"2026-10-20T22:18:37+00:00","modified_at":"2026-10-22T16:17:19+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}