---
id: "CVE-2026-101820"
kind: "vulnerability"
aliases: ["CVE-2026-101820"]
title: "Oracle E-Business Suite General Ledger: low-privilege network attack allows full takeover"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["erp", "general-ledger", "oracle-ebs", "self-hosted", "vendor"]
not_affected_if: ["other-release"]
published_at: "2026-10-20T22:18:37+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-25T03:19:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101820", "first_seen_at": "2026-10-23T21:57:23+00:00"}]
---

# Oracle E-Business Suite General Ledger: low-privilege network attack allows full takeover

Oracle E-Business Suite's General Ledger module, in the ADADMIN component, has a flaw in supported versions 12.2.3 through 12.2.15. A low-privileged user with network access over HTTP can, with difficulty, take over the General Ledger application, per NVD's CVSS 7.5 vector.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the Oracle E-Business Suite release in use is within `12.2.3` to `12.2.15`
- Check whether General Ledger is installed and reachable over HTTP from the network
- unknown for any other check, the sources do not say

## Fix

- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite General Ledger (the sources do not name the patch or target version)
- unknown for the specific patch number

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101820

## From the sources

Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: ADADMIN).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle General Ledger.  Successful attacks of this vulnerability can result in takeover of Oracle General Ledger. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_