---
id: "CVE-2026-101825"
kind: "vulnerability"
aliases: ["CVE-2026-101825"]
title: "Oracle E-Business Suite HCM Common Architecture: remote takeover by low-privileged users"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["hcm", "oracle-ebs", "self-hosted", "vendor"]
not_affected_if: ["unknown"]
published_at: "2026-10-20T22:18:38+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-25T03:18:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101825", "first_seen_at": "2026-10-23T21:57:23+00:00"}]
---

# Oracle E-Business Suite HCM Common Architecture: remote takeover by low-privileged users

Oracle HCM Common Architecture in E-Business Suite 12.2.3 through 12.2.15 has a flaw in its Internal Operations component. A low-privileged user with network access over HTTP can, with difficulty, take over the product, per the CVSS 3.1 vector.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed E-Business Suite release level against `12.2.3` through `12.2.15`
- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101825

## From the sources

Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HCM Common Architecture.  Successful attacks of this vulnerability can result in takeover of Oracle HCM Common Architecture. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_