{"id":"CVE-2026-101824","kind":"vulnerability","aliases":["CVE-2026-101824"],"related":[],"title":"Oracle E-Business Suite: Attachments flaw lets low-privilege user alter data","description":"Vulnerability in the Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Document Management and Collaboration.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Document Management and Collaboration, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Document Management and Collaboration accessible data as well as  unauthorized access to critical data or complete access to all Document Management and Collaboration accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).","summary":"Oracle E-Business Suite, Document Management and Collaboration (Attachments component): a low-privileged user with HTTP access can compromise it. The attack needs a victim, a person other than the attacker, to interact. Scope changes, so other products can be affected. Impact: create, modify or delete critical data and read all data the component can access. Oracle rates it CVSS 3.1 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N). Armis describes it as stored or reflected XSS, which Oracle has not confirmed. No exploitation in the wild is reported.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle E-Business Suite (Document Management and Collaboration, Attachments)","fixed":[],"affected":"12.2.3 - 12.2.15","ecosystem":"vendor"}],"ecosystems":[],"tags":["12.2.3-12.2.15","attachments","oracle e-business suite","oracle-e-business-suite","other","self-hosted"],"not_affected_if":["versions-outside-12.2.3-12.2.15"],"how_to_check":"Check whether you run Oracle E-Business Suite 12.2.3-12.2.15 with Document Management and Collaboration/Attachments in use. Run the latest EBS Critical Patch Update Checker (ECPUC, Patch 35583866) and read ECPUC.lst. It shows your current CPU/CSPU level and the required October 2026 patches.","fix":"Apply the October 2026 CPU/CSPU patches for E-Business Suite 12.2. Oracle lists them in MOS Knowledge Article KA923, which needs a support login. Exact patch number: unknown. No workaround is published.","status":"open","published_at":"2026-10-20T22:18:38+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-23T22:37:12+00:00","updated_at":"2026-10-24T00:05:12+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-23T22:37:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle E-Business Suite: Attachments flaw lets low-privilege user alter data","impact":"high","summary":"Oracle E-Business Suite's Attachments component (Document Management and Collaboration) has a flaw that lets a low-privileged user reach it over HTTP. A successful attack can create, delete, or modify critical data and read data the product can access, and it can affect other products.","category":"other","who_cares":["oracle e-business suite","attachments","12.2.3-12.2.15","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker modifies or deletes critical data and reads accessible data","analyst_note":"Find the Oracle Critical Patch Update advisory for CVE-2026-101824 to get the patched release and any workaround; the NVD entry does not name a fix.","how_to_check":"Check whether the installed E-Business Suite release falls within 12.2.3 through 12.2.15.","needs_analyst":true,"not_affected_if":["versions-outside-12.2.3-12.2.15"],"user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001,"input_tokens":3154,"output_tokens":1370,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Oracle Critical Patch Update advisory for CVE-2026-101824 to get the patched release and any workaround; the NVD entry does not name a fix.","search":"'-101824':17A,20A '-2026':16A,19A '/av':270C '12.2.15':32B,164C '12.2.3':31B,163C '3.1':110B,258C,269C '8.7':111B,261C 'access':66B,105B,174C,226C,236C,242C,248C,255C 'addit':209C 'affect':90B,161C 'allow':168C 'alter':13A 'and':28A 'armi':121B 'attach':6A,33B,57B,156C 'attachments':30A 'attack':71B,80B,171C,184C,194C,205C,214C 'av':112B 'base':259C 'busi':4A,37B,42B,51B,153C 'business':24A 'c/c':117B,275C 'chang':84B,212C 'collabor':56B,147C,182C,204C,235C,254C 'collaboration':29A 'complet':247C 'compon':58B,103B,155C 'compromis':68B,178C 'confidenti':262C 'confirm':133B 'creat':92B 'creation':222C 'critic':96B,228C,244C 'cve':15A,18A 'cvss':109B,257C,266C,268C 'data':14A,97B,101B,229C,237C,245C,256C 'delet':95B,223C 'describ':122B 'document':26A,53B,144C,179C,201C,232C,251C 'e':3A,23A,36B,41B,50B,152C 'e-busi':2A,35B,49B,151C 'e-business':22A 'easili':165C 'exploit':135B,166C 'flaw':7A 'h/a':119B,277C 'h/i':118B,276C 'host':47B 'http':65B,176C 'human':186C 'impact':91B,208C,265C 'integr':264C 'interact':82B,187C 'l/pr':114B,272C 'l/ui':115B,273C 'let':8A 'low':10A,61B,169C 'low-privileg':9A,60B 'manag':54B,145C,180C,202C,233C,252C 'management':27A 'may':206C 'modif':225C 'modifi':93B 'n':120B,278C 'n/ac':113B,271C 'need':72B 'network':173C 'oracl':1A,34B,40B,48B,106B,130B,150C 'oracle':21A 'oracle-e-business-suit':39B 'person':76B,190C 'privileg':11A,62B,170C 'product':87B,148C,210C 'r/s':116B,274C 'rate':107B 'read':99B 'reflect':127B 'report':140B 'requir':185C 'result':219C 'scope':83B,211C 'score':260C 'self':46B 'self-host':45B 'signific':207C 'store':125B 'success':183C,213C 'suit':5A,38B,43B,52B,154C 'suite':25A 'support':157C 'unauthor':221C,241C 'user':12A,63B 'vector':267C 'version':158C 'via':175C 'victim':74B 'vulner':141C,167C,198C,217C 'well':239C 'wild':138B 'xss':128B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101824","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101824","severity":null,"published_at":"2026-10-20T22:18:38+00:00","modified_at":"2026-10-22T16:17:19+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101824:584","url":null,"severity":null,"published_at":"2026-10-24T00:05:12+00:00","modified_at":"2026-10-24T00:05:12+00:00","first_seen_at":"2026-10-24T00:05:12+00:00","fetched_at":"2026-10-24T00:05:12+00:00","note":"Oracle October 2026 CPU (2026-10-20) lists EBS 12.2.3-12.2.15 as affected. The patch number is only in the MOS docs behind a login (KA923), so the fix is not named publicly. Oracle's CVSS is 8.7 with user interaction required and scope changed. That is not a plain data-alter flaw. Armis calls it XSS, a secondary source I could not confirm. No exploitation or public PoC found. I did not search social posts."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2337,"url":"https://blogs.oracle.com/ebstech/critical-patch-update-for-october-2026-now-available","title":"Critical Patch Update for October 2026 Now Available (EBS)","kind":"vendor","source":"analyst","text":"EBS CSPU/CPU for October 2026 released 20 Oct 2026. Oracle strongly recommends applying without delay. Latest EBS CPU doc is found via MOS KA923.","published_at":null,"relation":"fix","confidence":null,"note":null},{"id":2342,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-101824/","title":"Rapid7 DB: CVE-2026-101824","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2336,"url":"https://blogs.oracle.com/ebstech/october-2026-updates-to-ebs-critical-patch-update-checker-ecpuc","title":"October 2026 Updates to EBS Critical Patch Update Checker (ECPUC)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}