---
id: "CVE-2026-101824"
kind: "vulnerability"
aliases: ["CVE-2026-101824"]
title: "Oracle E-Business Suite: Attachments flaw lets low-privilege user alter data"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Oracle E-Business Suite (Document Management and Collaboration, Attachments)", "fixed": [], "affected": "12.2.3 - 12.2.15", "ecosystem": "vendor"}]
ecosystems: []
tags: ["12.2.3-12.2.15", "attachments", "oracle e-business suite", "oracle-e-business-suite", "other", "self-hosted"]
not_affected_if: ["versions-outside-12.2.3-12.2.15"]
published_at: "2026-10-20T22:18:38+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-24T00:05:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101824", "first_seen_at": "2026-10-23T21:57:23+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:05:12+00:00"}]
---

# Oracle E-Business Suite: Attachments flaw lets low-privilege user alter data

Oracle E-Business Suite, Document Management and Collaboration (Attachments component): a low-privileged user with HTTP access can compromise it. The attack needs a victim, a person other than the attacker, to interact. Scope changes, so other products can be affected. Impact: create, modify or delete critical data and read all data the component can access. Oracle rates it CVSS 3.1 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N). Armis describes it as stored or reflected XSS, which Oracle has not confirmed. No exploitation in the wild is reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle E-Business Suite (Document Management and Collaboration, Attachments) affected 12.2.3 - 12.2.15 fixed ?

## How to check

Check whether you run Oracle E-Business Suite 12.2.3-12.2.15 with Document Management and Collaboration/Attachments in use. Run the latest EBS Critical Patch Update Checker (ECPUC, Patch 35583866) and read ECPUC.lst. It shows your current CPU/CSPU level and the required October 2026 patches.

## Fix

Apply the October 2026 CPU/CSPU patches for E-Business Suite 12.2. Oracle lists them in MOS Knowledge Article KA923, which needs a support login. Exact patch number: unknown. No workaround is published.

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101824
- 2026-10-24T00:05:12+00:00 analyst — Oracle October 2026 CPU (2026-10-20) lists EBS 12.2.3-12.2.15 as affected. The patch number is only in the MOS docs behind a login (KA923), so the fix is not named publicly. Oracle's CVSS is 8.7 with user interaction required and scope changed. That is not a plain data-alter flaw. Armis calls it XSS, a secondary source I could not confirm. No exploitation or public PoC found. I did not search social posts.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] Rapid7 DB: CVE-2026-101824 https://www.rapid7.com/db/vulnerabilities/cve-2026-101824/
- [fix] Critical Patch Update for October 2026 Now Available (EBS) https://blogs.oracle.com/ebstech/critical-patch-update-for-october-2026-now-available
- [mitigation] October 2026 Updates to EBS Critical Patch Update Checker (ECPUC) https://blogs.oracle.com/ebstech/october-2026-updates-to-ebs-critical-patch-update-checker-ecpuc

## From the sources

Vulnerability in the Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Document Management and Collaboration.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Document Management and Collaboration, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Document Management and Collaboration accessible data as well as  unauthorized access to critical data or complete access to all Document Management and Collaboration accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_