---
id: "CVE-2026-101850"
kind: "vulnerability"
aliases: ["CVE-2026-101850"]
title: "Oracle E-Business Suite: Installed Base HTML UI flaw exposes some data to attackers"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["erp", "installed-base", "oracle-ebs", "self-hosted", "vendor"]
not_affected_if: ["default-config"]
published_at: "2026-10-20T22:18:40+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-25T04:03:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101850", "first_seen_at": "2026-10-23T21:57:23+00:00"}]
---

# Oracle E-Business Suite: Installed Base HTML UI flaw exposes some data to attackers

An unauthenticated attacker over HTTP can read and modify a subset of data in Oracle E-Business Suite's Installed Base module, but only if a user is tricked into interacting with a crafted request. The flaw is in the HTML UI of supported releases 12.2.3 through 12.2.15, and the scope change means other products in the suite may also be affected.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Oracle E-Business Suite release in the application (Help > About) or the `$APPL_TOP` patch level, and see whether it falls within `12.2.3` to `12.2.15`.
- Confirm whether the Installed Base module is in use.

## Fix

- Apply the Oracle Critical Patch Update fix for Installed Base in Oracle E-Business Suite, per Oracle's advisory (unknown exact patch in sources).
- Move to a supported release outside `12.2.3` to `12.2.15` (unknown target version in sources).

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101850

## From the sources

Vulnerability in the Installed Base product of Oracle E-Business Suite (component: HTML UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Installed Base.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Installed Base, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Installed Base accessible data as well as  unauthorized read access to a subset of Installed Base accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_