---
id: "CVE-2026-101851"
kind: "vulnerability"
aliases: ["CVE-2026-101851"]
title: "Oracle E-Business Suite: Installed Base flaw lets low-privileged users read and change data"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["erp", "installed-base", "oracle-ebs", "package"]
not_affected_if: ["default-config"]
published_at: "2026-10-20T22:18:41+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-25T03:34:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101851", "first_seen_at": "2026-10-23T21:57:23+00:00"}]
---

# Oracle E-Business Suite: Installed Base flaw lets low-privileged users read and change data

A flaw in the Data Provider UI component of Oracle E-Business Suite's Installed Base product lets an attacker with a low-privilege account reach it over HTTP. Successful exploitation exposes critical Installed Base data and allows some unauthorized updates, inserts and deletes.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed E-Business Suite release level for `12.2.3` through `12.2.15` in the Oracle EBS environment.
- Confirm whether the Installed Base module is licensed and in use.

## Fix

- Apply the Oracle Critical Patch Update fix for Installed Base, as listed in Oracle's security advisory for this CVE (version not stated in sources).
- unknown

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101851

## From the sources

Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Data Provider UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Installed Base.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Installed Base accessible data as well as  unauthorized update, insert or delete access to some of Installed Base accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_