---
id: "CVE-2026-101847"
kind: "vulnerability"
aliases: ["CVE-2026-101847"]
title: "Oracle E-Business Suite: Bills of Material flaw lets low-privileged users take over"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["bills-of-material", "erp", "on-prem", "oracle-ebs", "vendor"]
not_affected_if: ["unknown"]
published_at: "2026-10-20T22:18:40+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-25T03:18:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101847", "first_seen_at": "2026-10-23T21:57:23+00:00"}]
---

# Oracle E-Business Suite: Bills of Material flaw lets low-privileged users take over

Oracle Bills of Material, part of Oracle E-Business Suite, has a flaw in its Internal Operations component that lets a low-privileged attacker reach it over HTTP and take it over. Per the description, a successful attack gives full control over confidentiality, integrity and availability for that module.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Oracle E-Business Suite release and confirm whether Bills of Material falls in `12.2.3` through `12.2.15`
- unknown for any further check; the sources do not name the specific files or settings to inspect

## Fix

- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Bills of Material; the sources do not name the patch number or fixed version
- unknown for any other action; the sources do not say

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101847

## From the sources

Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material.  Successful attacks of this vulnerability can result in takeover of Oracle Bills of Material. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_