{"id":"CVE-2026-101851","kind":"vulnerability","aliases":["CVE-2026-101851"],"related":[],"title":"Oracle E-Business Suite: Installed Base flaw lets low-privileged users read and change data","description":"Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Data Provider UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Installed Base.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Installed Base accessible data as well as  unauthorized update, insert or delete access to some of Installed Base accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).","summary":"A flaw in the Data Provider UI component of Oracle E-Business Suite's Installed Base product lets an attacker with a low-privilege account reach it over HTTP. Successful exploitation exposes critical Installed Base data and allows some unauthorized updates, inserts and deletes.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erp","installed-base","oracle-ebs","package"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed E-Business Suite release level for `12.2.3` through `12.2.15` in the Oracle EBS environment.\n- Confirm whether the Installed Base module is licensed and in use.","fix":"- Apply the Oracle Critical Patch Update fix for Installed Base, as listed in Oracle's security advisory for this CVE (version not stated in sources).\n- unknown","status":"open","published_at":"2026-10-20T22:18:41+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T03:34:19+00:00","updated_at":"2026-10-25T03:34:19+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:34:19Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Installed Base, as listed in Oracle's security advisory for this CVE (version not stated in sources).\n- unknown","reach":"network","title":"Oracle E-Business Suite: Installed Base flaw lets low-privileged users read and change data","impact":"high","summary":"A flaw in the Data Provider UI component of Oracle E-Business Suite's Installed Base product lets an attacker with a low-privilege account reach it over HTTP. Successful exploitation exposes critical Installed Base data and allows some unauthorized updates, inserts and deletes.","category":"package","nicknames":[],"who_cares":["oracle-ebs","installed-base","erp"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads and modifies Installed Base data with a low-privilege account","analyst_note":"Find Oracle's Critical Patch Update advisory for CVE-2026-101851 to confirm the patch level and any workaround; sources give only the NVD description.","how_to_check":"- Check the installed E-Business Suite release level for `12.2.3` through `12.2.15` in the Oracle EBS environment.\n- Confirm whether the Installed Base module is licensed and in use.","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Organizations running Oracle E-Business Suite release 12.2.3 through 12.2.15 with the Installed Base product exposed over HTTP. Sites on other release levels or without Installed Base can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000636,"input_tokens":3478,"output_tokens":576,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101851':20A,23A '-2026':19A,22A '/av':169C '12.2.15':101C '12.2.3':100C '3.1':157C,168C '7.1':160C 'access':111C,127C,133C,138C,148C,154C 'account':58B 'affect':98C 'allow':71B,105C 'attack':52B,108C,119C 'base':7A,27B,48B,68B,82C,117C,137C,153C,158C 'busi':4A,44B,88C 'chang':16A 'complet':132C 'compon':39B,90C 'compromis':115C 'confidenti':161C 'critic':66B,129C 'cve':18A,21A 'cvss':156C,165C,167C 'data':17A,36B,69B,91C,130C,139C,155C 'delet':77B,147C 'e':3A,43B,87C 'e-busi':2A,42B,86C 'easili':102C 'eb':30B 'erp':24B 'exploit':64B,103C 'expos':65B 'flaw':8A,33B 'h/i':175C 'http':62B,113C 'impact':164C 'insert':75B,145C 'instal':6A,26B,47B,67B,81C,116C,136C,152C 'installed-bas':25B 'integr':163C 'l/a':176C 'l/pr':171C 'l/ui':172C 'let':9A,50B 'low':11A,56B,106C 'low-privileg':10A,55B 'n':177C 'n/ac':170C 'n/s':173C 'network':110C 'oracl':1A,29B,41B,85C 'oracle-eb':28B 'packag':31B 'privileg':12A,57B,107C 'product':49B,83C 'provid':37B,92C 'reach':59B 'read':14A 'result':124C 'score':159C 'success':63B,118C 'suit':5A,45B,89C 'support':94C 'u/c':174C 'ui':38B,93C 'unauthor':73B,126C,143C 'updat':74B,144C 'user':13A 'vector':166C 'version':95C 'via':112C 'vulner':78C,104C,122C 'well':141C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite release 12.2.3 through 12.2.15 with the Installed Base product exposed over HTTP. Sites on other release levels or without Installed Base can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101851","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101851","severity":null,"published_at":"2026-10-20T22:18:41+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}