{"id":"CVE-2026-101850","kind":"vulnerability","aliases":["CVE-2026-101850"],"related":[],"title":"Oracle E-Business Suite: Installed Base HTML UI flaw exposes some data to attackers","description":"Vulnerability in the Installed Base product of Oracle E-Business Suite (component: HTML UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Installed Base.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Installed Base, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Installed Base accessible data as well as  unauthorized read access to a subset of Installed Base accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","summary":"An unauthenticated attacker over HTTP can read and modify a subset of data in Oracle E-Business Suite's Installed Base module, but only if a user is tricked into interacting with a crafted request. The flaw is in the HTML UI of supported releases 12.2.3 through 12.2.15, and the scope change means other products in the suite may also be affected.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erp","installed-base","oracle-ebs","self-hosted","vendor"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed Oracle E-Business Suite release in the application (Help > About) or the `$APPL_TOP` patch level, and see whether it falls within `12.2.3` to `12.2.15`.\n- Confirm whether the Installed Base module is in use.","fix":"- Apply the Oracle Critical Patch Update fix for Installed Base in Oracle E-Business Suite, per Oracle's advisory (unknown exact patch in sources).\n- Move to a supported release outside `12.2.3` to `12.2.15` (unknown target version in sources).","status":"open","published_at":"2026-10-20T22:18:40+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T04:03:46+00:00","updated_at":"2026-10-25T04:03:46+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T04:03:46Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Installed Base in Oracle E-Business Suite, per Oracle's advisory (unknown exact patch in sources).\n- Move to a supported release outside `12.2.3` to `12.2.15` (unknown target version in sources).","reach":"network","title":"Oracle E-Business Suite: Installed Base HTML UI flaw exposes some data to attackers","impact":"medium","summary":"An unauthenticated attacker over HTTP can read and modify a subset of data in Oracle E-Business Suite's Installed Base module, but only if a user is tricked into interacting with a crafted request. The flaw is in the HTML UI of supported releases 12.2.3 through 12.2.15, and the scope change means other products in the suite may also be affected.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","installed-base","erp","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reads and alters some Installed Base data, affecting other suite products.","analyst_note":"Check Oracle's Critical Patch Update advisory for the exact patch and fixed release; sources only give the affected range.","how_to_check":"- Check the installed Oracle E-Business Suite release in the application (Help > About) or the `$APPL_TOP` patch level, and see whether it falls within `12.2.3` to `12.2.15`.\n- Confirm whether the Installed Base module is in use.","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Installed Base module exposed to users over HTTP. Systems not running those releases or not using Installed Base can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000679,"input_tokens":3526,"output_tokens":653,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101850':18A,21A '-2026':17A,20A '/av':210C '12.2.15':81B,118C '12.2.3':79B,117C '3.1':198C,209C '6.1':201C 'access':127C,175C,181C,188C,195C 'addit':158C 'affect':95B,115C 'allow':122C 'also':93B 'attack':15A,35B,124C,135C,145C,154C,163C 'base':7A,25B,54B,100C,133C,153C,180C,194C,199C 'busi':4A,50B,106C 'c/c':215C 'chang':85B,161C 'compon':108C 'compromis':131C 'confidenti':202C 'craft':67B 'cve':16A,19A 'cvss':197C,206C,208C 'data':13A,45B,182C,196C 'delet':174C 'e':3A,49B,105C 'e-busi':2A,48B,104C 'easili':119C 'eb':28B 'erp':22B 'exploit':120C 'expos':11A 'flaw':10A,70B 'host':31B 'html':8A,74B,109C 'http':37B,129C 'human':137C 'impact':157C,205C 'insert':172C 'instal':6A,24B,53B,99C,132C,152C,179C,193C 'installed-bas':23B 'integr':204C 'interact':64B,138C 'l/a':217C 'l/i':216C 'l/pr':212C 'may':92B,155C 'mean':86B 'modifi':41B 'modul':55B 'n':218C 'n/ac':211C 'n/ui':213C 'network':126C 'oracl':1A,27B,47B,103C 'oracle-eb':26B 'person':141C 'product':88B,101C,159C 'r/s':214C 'read':39B,187C 'releas':78B 'request':68B 'requir':136C 'result':168C 'scope':84B,160C 'score':200C 'self':30B 'self-host':29B 'signific':156C 'subset':43B,191C 'success':134C,162C 'suit':5A,51B,91B,107C 'support':77B,111C 'trick':62B 'ui':9A,75B,110C 'unauthent':34B,123C 'unauthor':170C,186C 'updat':171C 'user':60B 'vector':207C 'vendor':32B 'version':112C 'via':128C 'vulner':96C,121C,149C,166C 'well':184C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Installed Base module exposed to users over HTTP. Systems not running those releases or not using Installed Base can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101850","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101850","severity":null,"published_at":"2026-10-20T22:18:40+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}