{"id":"CVE-2026-101826","kind":"vulnerability","aliases":["CVE-2026-101826"],"related":[],"title":"Oracle E-Business Suite HCM Common Architecture: low-privilege network attacker can take over","description":"Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HCM Common Architecture.  Successful attacks of this vulnerability can result in takeover of Oracle HCM Common Architecture. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle HCM Common Architecture in E-Business Suite 12.2.3 through 12.2.15 has a flaw in the Internal Operations component. A low-privileged user with network access over HTTP can exploit it, with difficulty, to take over the product.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise-apps","hcm","oracle-ebs","package","self-hosted"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check the installed E-Business Suite release and HCM Common Architecture patch level against the affected range `12.2.3` to `12.2.15`\n- unknown","fix":"- Apply the Oracle Critical Patch Update fix for CVE-2026-101826 (patch identifier unknown from sources)\n- unknown","status":"open","published_at":"2026-10-20T22:18:38+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T03:18:59+00:00","updated_at":"2026-10-25T03:18:59+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:18:59Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for CVE-2026-101826 (patch identifier unknown from sources)\n- unknown","reach":"network","title":"Oracle E-Business Suite HCM Common Architecture: low-privilege network attacker can take over","impact":"high","summary":"Oracle HCM Common Architecture in E-Business Suite 12.2.3 through 12.2.15 has a flaw in the Internal Operations component. A low-privileged user with network access over HTTP can exploit it, with difficulty, to take over the product.","category":"package","nicknames":[],"who_cares":["oracle-ebs","hcm","self-hosted","enterprise-apps"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over Oracle HCM Common Architecture, with full confidentiality, integrity and availability impact","analyst_note":"Confirm the patch identifier and fixed release from Oracle's Critical Patch Update advisory, and whether a specific configuration is required; the NVD entry alone does not give fix or check steps.","how_to_check":"- Check the installed E-Business Suite release and HCM Common Architecture patch level against the affected range `12.2.3` to `12.2.15`\n- unknown","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organizations running Oracle E-Business Suite with HCM Common Architecture in the affected 12.2.3 to 12.2.15 range that expose its HTTP interface to a network. Sites on unaffected releases or with the HTTP interface restricted to trusted users can likely skip it, but the sources do not confirm this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000653,"input_tokens":3467,"output_tokens":613,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101826':18A,21A '-2026':17A,20A '/av':145C '12.2.15':44B,97C '12.2.3':42B,96C '3.1':132C,144C '7.5':135C 'access':60B,108C 'affect':94C 'allow':102C 'app':24B 'architectur':8A,36B,79C,116C,130C 'attack':13A,105C,118C 'avail':139C 'base':133C 'busi':4A,40B,85C 'common':7A,35B,78C,115C,129C 'compon':52B,87C 'compromis':112C 'confidenti':136C 'cve':16A,19A 'cvss':131C,141C,143C 'difficult':98C 'difficulti':67B 'e':3A,39B,84C 'e-busi':2A,38B,83C 'eb':28B 'enterpris':23B 'enterprise-app':22B 'exploit':64B,100C 'flaw':47B 'h':153C 'h/a':152C 'h/i':151C 'h/pr':147C 'hcm':6A,25B,34B,77C,114C,128C 'host':32B 'http':62B,110C 'impact':140C 'integr':137C 'intern':50B,88C 'l/ui':148C 'low':10A,55B,103C 'low-privileg':9A,54B 'n/ac':146C 'n/s':149C 'network':12A,59B,107C 'oper':51B,89C 'oracl':1A,27B,33B,76C,82C,113C,127C 'oracle-eb':26B 'packag':29B 'privileg':11A,56B,104C 'product':72B,80C 'result':123C 'score':134C 'self':31B 'self-host':30B 'success':117C 'suit':5A,41B,86C 'support':90C 'take':15A,69B 'takeov':125C 'u/c':150C 'user':57B 'vector':142C 'version':91C 'via':109C 'vulner':73C,101C,121C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite with HCM Common Architecture in the affected 12.2.3 to 12.2.15 range that expose its HTTP interface to a network. Sites on unaffected releases or with the HTTP interface restricted to trusted users can likely skip it, but the sources do not confirm this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101826","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101826","severity":null,"published_at":"2026-10-20T22:18:38+00:00","modified_at":"2026-10-22T16:17:19+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}