{"id":"CVE-2026-101847","kind":"vulnerability","aliases":["CVE-2026-101847"],"related":[],"title":"Oracle E-Business Suite: Bills of Material flaw lets low-privileged users take over","description":"Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material.  Successful attacks of this vulnerability can result in takeover of Oracle Bills of Material. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Bills of Material, part of Oracle E-Business Suite, has a flaw in its Internal Operations component that lets a low-privileged attacker reach it over HTTP and take it over. Per the description, a successful attack gives full control over confidentiality, integrity and availability for that module.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bills-of-material","erp","on-prem","oracle-ebs","vendor"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed Oracle E-Business Suite release and confirm whether Bills of Material falls in `12.2.3` through `12.2.15`\n- unknown for any further check; the sources do not name the specific files or settings to inspect","fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Bills of Material; the sources do not name the patch number or fixed version\n- unknown for any other action; the sources do not say","status":"open","published_at":"2026-10-20T22:18:40+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T03:18:56+00:00","updated_at":"2026-10-25T03:18:56+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:18:56Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Bills of Material; the sources do not name the patch number or fixed version\n- unknown for any other action; the sources do not say","reach":"network","title":"Oracle E-Business Suite: Bills of Material flaw lets low-privileged users take over","impact":"high","summary":"Oracle Bills of Material, part of Oracle E-Business Suite, has a flaw in its Internal Operations component that lets a low-privileged attacker reach it over HTTP and take it over. Per the description, a successful attack gives full control over confidentiality, integrity and availability for that module.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","bills-of-material","erp","on-prem"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over Bills of Material, reading, changing and disrupting its data","analyst_note":"Find Oracle's CPU advisory and patch number for CVE-2026-101847 and the list of fixed EBS versions; the NVD entry does not give them.","how_to_check":"- Check the installed Oracle E-Business Suite release and confirm whether Bills of Material falls in `12.2.3` through `12.2.15`\n- unknown for any further check; the sources do not name the specific files or settings to inspect","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running Oracle E-Business Suite Bills of Material in the affected `12.2.3` to `12.2.15` range, where the module is reachable over HTTP by low-privileged users. The sources do not say which deployment or configuration choices make an instance exposed, so the exact exposure is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000663,"input_tokens":3455,"output_tokens":634,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101847':18A,21A '-2026':17A,20A '/av':157C '12.2.15':109C '12.2.3':108C '3.1':144C,156C '7.5':147C 'access':120C 'affect':106C 'allow':114C 'attack':59B,73B,117C,130C 'avail':81B,151C 'base':145C 'bill':6A,23B,35B,89C,126C,140C 'bills-of-materi':22B 'busi':4A,43B,97C 'compon':52B,99C 'compromis':124C 'confidenti':78B,148C 'control':76B 'cve':16A,19A 'cvss':143C,153C,155C 'descript':70B 'difficult':110C 'e':3A,42B,96C 'e-busi':2A,41B,95C 'eb':32B 'erp':26B 'exploit':112C 'flaw':9A,47B 'full':75B 'give':74B 'h':165C 'h/a':164C 'h/i':163C 'h/pr':159C 'http':63B,122C 'impact':152C 'integr':79B,149C 'intern':50B,100C 'l/ui':160C 'let':10A,54B 'low':12A,57B,115C 'low-privileg':11A,56B 'materi':8A,25B,37B,91C,128C,142C 'modul':84B 'n/ac':158C 'n/s':161C 'network':119C 'on-prem':27B 'oper':51B,101C 'oracl':1A,31B,34B,40B,88C,94C,125C,139C 'oracle-eb':30B 'part':38B 'per':68B 'prem':29B 'privileg':13A,58B,116C 'product':92C 'reach':60B 'result':135C 'score':146C 'success':72B,129C 'suit':5A,44B,98C 'support':102C 'take':15A,65B 'takeov':137C 'u/c':162C 'user':14A 'vector':154C 'vendor':33B 'version':103C 'via':121C 'vulner':85C,113C,133C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite Bills of Material in the affected `12.2.3` to `12.2.15` range, where the module is reachable over HTTP by low-privileged users. The sources do not say which deployment or configuration choices make an instance exposed, so the exact exposure is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101847","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101847","severity":null,"published_at":"2026-10-20T22:18:40+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}