{"id":"CVE-2026-101825","kind":"vulnerability","aliases":["CVE-2026-101825"],"related":[],"title":"Oracle E-Business Suite HCM Common Architecture: remote takeover by low-privileged users","description":"Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HCM Common Architecture.  Successful attacks of this vulnerability can result in takeover of Oracle HCM Common Architecture. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle HCM Common Architecture in E-Business Suite 12.2.3 through 12.2.15 has a flaw in its Internal Operations component. A low-privileged user with network access over HTTP can, with difficulty, take over the product, per the CVSS 3.1 vector.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hcm","oracle-ebs","self-hosted","vendor"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed E-Business Suite release level against `12.2.3` through `12.2.15`\n- unknown","fix":"- unknown","status":"open","published_at":"2026-10-20T22:18:38+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T03:18:59+00:00","updated_at":"2026-10-25T03:18:59+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:18:59Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Oracle E-Business Suite HCM Common Architecture: remote takeover by low-privileged users","impact":"high","summary":"Oracle HCM Common Architecture in E-Business Suite 12.2.3 through 12.2.15 has a flaw in its Internal Operations component. A low-privileged user with network access over HTTP can, with difficulty, take over the product, per the CVSS 3.1 vector.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","hcm","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker takes over the HCM Common Architecture product","analyst_note":"Check Oracle's Critical Patch Update advisory for the patch level and fixed release, since the sources give no fix version.","how_to_check":"- Check the installed E-Business Suite release level against `12.2.3` through `12.2.15`\n- unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Sources describe Oracle E-Business Suite HCM Common Architecture, Internal Operations, supported versions 12.2.3 through 12.2.15. Exposure needs a low-privileged account reachable over HTTP, and the sources do not say which configurations are affected beyond that. Teams running other Oracle EBS releases can likely skip it, but the sources do not confirm this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000611,"input_tokens":3467,"output_tokens":528,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101825':18A,21A '-2026':17A,20A '/av':144C '12.2.15':41B,96C '12.2.3':39B,95C '3.1':70B,131C,143C '7.5':134C 'access':57B,107C 'affect':93C 'allow':101C 'architectur':8A,33B,78C,115C,129C 'attack':104C,117C 'avail':138C 'base':132C 'busi':4A,37B,84C 'common':7A,32B,77C,114C,128C 'compon':49B,86C 'compromis':111C 'confidenti':135C 'cve':16A,19A 'cvss':69B,130C,140C,142C 'difficult':97C 'difficulti':62B 'e':3A,36B,83C 'e-busi':2A,35B,82C 'eb':25B 'exploit':99C 'flaw':44B 'h':152C 'h/a':151C 'h/i':150C 'h/pr':146C 'hcm':6A,22B,31B,76C,113C,127C 'host':28B 'http':59B,109C 'impact':139C 'integr':136C 'intern':47B,87C 'l/ui':147C 'low':13A,52B,102C 'low-privileg':12A,51B 'n/ac':145C 'n/s':148C 'network':56B,106C 'oper':48B,88C 'oracl':1A,24B,30B,75C,81C,112C,126C 'oracle-eb':23B 'per':67B 'privileg':14A,53B,103C 'product':66B,79C 'remot':9A 'result':122C 'score':133C 'self':27B 'self-host':26B 'success':116C 'suit':5A,38B,85C 'support':89C 'take':63B 'takeov':10A,124C 'u/c':149C 'user':15A,54B 'vector':71B,141C 'vendor':29B 'version':90C 'via':108C 'vulner':72C,100C,120C","nicknames":[],"mitigations":[],"who_affected":"Sources describe Oracle E-Business Suite HCM Common Architecture, Internal Operations, supported versions 12.2.3 through 12.2.15. Exposure needs a low-privileged account reachable over HTTP, and the sources do not say which configurations are affected beyond that. Teams running other Oracle EBS releases can likely skip it, but the sources do not confirm this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101825","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101825","severity":null,"published_at":"2026-10-20T22:18:38+00:00","modified_at":"2026-10-22T16:17:19+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}