{"id":"CVE-2026-101842","kind":"vulnerability","aliases":["CVE-2026-101842"],"related":[],"title":"Oracle E-Business Suite SNO installer: unauthenticated takeover over HTTP","description":"Vulnerability in the Strategic Network Optimization product of Oracle E-Business Suite (component: Installation of SNO).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Strategic Network Optimization.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Strategic Network Optimization. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","summary":"The Strategic Network Optimization component of Oracle E-Business Suite 12.2.3 through 12.2.15 has a flaw reachable over HTTP without a login. An attacker who tricks a user into one action can take over the SNO component.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle E-Business Suite Strategic Network Optimization","fixed":["Oct 2026 CPU patch 40022426:12.2.0 (per Rapid7, unconfirmed)"],"affected":">= 12.2.3, <= 12.2.15","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","oracle-e-business-suite","self-hosted","strategic-network-optimization"],"not_affected_if":["sno-not-installed"],"how_to_check":"Check whether Strategic Network Optimization (SNO) is installed in your EBS 12.2.3-12.2.15 environment (Oracle Applications Manager / AD patch history for the SNO product). If SNO is not installed you are not affected. Then check that the Oct 2026 EBS CPU patch (Rapid7 lists 40022426:12.2.0) is applied. Default-install status of SNO is unknown; the MOS patch availability doc should settle it.","fix":"Apply the Oracle October 2026 Critical Patch Update for E-Business Suite (Rapid7 lists Patch 40022426:12.2.0; confirm in the MOS patch availability document, as that number is from a secondary source). Oracle names no workaround.","status":"open","published_at":"2026-10-20T22:18:40+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-23T22:38:35+00:00","updated_at":"2026-10-24T00:05:08+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T22:38:35Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Oracle Critical Patch Update fix for SNO in E-Business Suite 12.2.3-12.2.15; exact patch name unknown from sources.","reach":"internet","title":"Oracle E-Business Suite SNO installer: unauthenticated takeover over HTTP","impact":"high","summary":"The Strategic Network Optimization component of Oracle E-Business Suite 12.2.3 through 12.2.15 has a flaw reachable over HTTP without a login. An attacker who tricks a user into one action can take over the SNO component.","category":"infrastructure","who_cares":["oracle-e-business-suite","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker takes over the SNO component over the network","analyst_note":"Find the Oracle Security Alert advisory and patch ID for SNO and check whether SNO installs by default; source URL is only NVD.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["sno-not-installed"],"user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000508,"input_tokens":3104,"output_tokens":395,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Oracle Security Alert advisory and patch ID for SNO and check whether SNO installs by default; source URL is only NVD.","search":"'-101842':14A,17A '-2026':13A,16A '/av':157C '12.2.15':52B,101C '12.2.3':50B,100C '3.1':144C,156C '8.8':147C 'access':110C 'action':70B 'affect':98C 'allow':105C 'attack':63B,107C,119C,129C,131C 'avail':151C 'base':145C 'busi':4A,30B,48B,88C 'business':21A 'compon':43B,76B,90C 'compromis':114C 'confidenti':148C 'cve':12A,15A 'cvss':143C,153C,155C 'e':3A,20A,29B,47B,87C 'e-busi':2A,46B,86C 'e-business':19A 'easili':102C 'exploit':103C 'flaw':55B 'h':165C 'h/a':164C 'h/i':163C 'host':34B 'http':11A,58B,112C 'human':121C 'impact':152C 'infrastructur':26B 'instal':7A,91C 'integr':149C 'interact':122C 'l/pr':159C 'login':61B 'n/ac':158C 'n/ui':160C 'network':24A,37B,41B,81C,109C,116C,141C 'one':69B 'optim':38B,42B,82C,117C,142C 'optimization':25A 'oracl':1A,28B,45B,85C 'oracle':18A 'oracle-e-business-suit':27B 'person':125C 'product':83C 'r/s':161C 'reachabl':56B 'requir':120C 'result':136C 'score':146C 'self':33B 'self-host':32B 'sno':6A,75B,93C 'strateg':36B,40B,80C,115C,140C 'strategic':23A 'strategic-network-optim':35B 'success':118C,130C 'suit':5A,31B,49B,89C 'suite':22A 'support':94C 'take':72B 'takeov':9A,138C 'trick':65B 'u/c':162C 'unauthent':8A,106C 'user':67B 'vector':154C 'version':95C 'via':111C 'vulner':77C,104C,134C 'without':59B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101842","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101842","severity":null,"published_at":"2026-10-20T22:18:40+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101842:583","url":null,"severity":null,"published_at":"2026-10-24T00:05:08+00:00","modified_at":"2026-10-24T00:05:08+00:00","first_seen_at":"2026-10-24T00:05:08+00:00","fetched_at":"2026-10-24T00:05:08+00:00","note":"Oracle CPU Oct 2026 (oracle.com/security-alerts/cpuoct2026.html) lists EBS 12.2.3-12.2.15; the CVE-specific row and the SNO patch number were not in the page text I got. Rapid7 (secondary source) names Patch 40022426:12.2.0 for the Oct-2026 EBS CPU; verify it in the MOS patch availability doc. Whether SNO installs by default: unknown. No exploitation or PoC found, KEV false. I did not search social posts."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2339,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-101842/","title":"Rapid7 DB: CVE-2026-101842 (patch 40022426:12.2.0)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}