{"id":"CVE-2026-101841","kind":"vulnerability","aliases":["CVE-2026-101841"],"related":[],"title":"Oracle E-Business Suite: Global Order Promising web service flaw exposes order data","description":"Vulnerability in the Global Order Promising product of Oracle E-Business Suite (component: Web Service).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Global Order Promising.  While the vulnerability is in Global Order Promising, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Global Order Promising accessible data as well as  unauthorized access to critical data or complete access to all Global Order Promising accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).","summary":"The Web Service component of Oracle E-Business Suite's Global Order Promising product (versions 12.2.3 through 12.2.15) has a flaw that lets a low-privileged remote user create, change or delete critical data and read all data the module can access. Oracle scores it CVSS 8.2 with scope change, so attacks can reach beyond the module.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise-erp","global-order-promising","oracle-ebs","package"],"not_affected_if":["module-not-deployed"],"how_to_check":"- Check the installed Oracle E-Business Suite release and whether the Global Order Promising module is in use, for example `unknown` from the sources\n- Review Oracle's Critical Patch Update advisory for the matching patch level, `unknown` from the sources","fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Global Order Promising, moving past `12.2.15`, `unknown` for the exact patch name in the sources","status":"open","published_at":"2026-10-20T22:18:40+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T03:04:06+00:00","updated_at":"2026-10-25T03:04:06+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:04:06Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Global Order Promising, moving past `12.2.15`, `unknown` for the exact patch name in the sources","reach":"network","title":"Oracle E-Business Suite: Global Order Promising web service flaw exposes order data","impact":"high","summary":"The Web Service component of Oracle E-Business Suite's Global Order Promising product (versions 12.2.3 through 12.2.15) has a flaw that lets a low-privileged remote user create, change or delete critical data and read all data the module can access. Oracle scores it CVSS 8.2 with scope change, so attacks can reach beyond the module.","category":"package","nicknames":[],"who_cares":["oracle-ebs","global-order-promising","enterprise-erp"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker alters or deletes critical order data and reads accessible records","analyst_note":"Find Oracle's CPU advisory for this CVE to get the exact patch and any detection steps; sources only give NVD text.","how_to_check":"- Check the installed Oracle E-Business Suite release and whether the Global Order Promising module is in use, for example `unknown` from the sources\n- Review Oracle's Critical Patch Update advisory for the matching patch level, `unknown` from the sources","needs_analyst":true,"not_affected_if":["module-not-deployed"],"who_is_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Global Order Promising module exposed to HTTP access by low-privileged users. Sites without Global Order Promising deployed, or on versions outside that range, are not listed as affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000668,"input_tokens":3523,"output_tokens":631,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101841':17A,20A '-2026':16A,19A '/av':204C '12.2.15':50B,114C '12.2.3':48B,113C '3.1':192C,203C '8.2':80B,195C 'access':75B,125C,162C,171C,177C,183C,189C 'addit':145C 'affect':111C 'allow':119C 'attack':85B,122C,141C,150C 'base':193C 'beyond':88B 'busi':4A,40B,102C 'c/c':209C 'chang':63B,83B,148C 'complet':182C 'compon':35B,104C 'compromis':129C 'confidenti':196C 'creat':62B 'creation':158C 'critic':66B,164C,179C 'cve':15A,18A 'cvss':79B,191C,200C,202C 'data':14A,67B,71B,165C,172C,180C,190C 'delet':65B,159C 'difficult':115C 'e':3A,39B,101C 'e-busi':2A,38B,100C 'eb':30B 'enterpris':22B 'enterprise-erp':21B 'erp':23B 'exploit':117C 'expos':12A 'flaw':11A,53B 'global':6A,25B,43B,94C,130C,138C,168C,186C 'global-order-promis':24B 'h/a':211C 'h/i':210C 'h/pr':206C 'http':127C 'impact':144C,199C 'integr':198C 'l/ui':207C 'let':55B 'low':58B,120C 'low-privileg':57B 'may':142C 'modif':161C 'modul':73B,90B 'n':212C 'n/ac':205C 'n/s':208C 'network':124C 'oracl':1A,29B,37B,76B,99C 'oracle-eb':28B 'order':7A,13A,26B,44B,95C,131C,139C,169C,187C 'packag':31B 'privileg':59B,121C 'product':46B,97C,146C 'promis':8A,27B,45B,96C,132C,140C,170C,188C 'reach':87B 'read':69B 'remot':60B 'result':155C 'scope':82B,147C 'score':77B,194C 'servic':10A,34B,106C 'signific':143C 'success':149C 'suit':5A,41B,103C 'support':107C 'unauthor':157C,176C 'user':61B 'vector':201C 'version':47B,108C 'via':126C 'vulner':91C,118C,135C,153C 'web':9A,33B,105C 'well':174C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Global Order Promising module exposed to HTTP access by low-privileged users. Sites without Global Order Promising deployed, or on versions outside that range, are not listed as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101841","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101841","severity":null,"published_at":"2026-10-20T22:18:40+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}