{"id":"CVE-2026-101856","kind":"vulnerability","aliases":["CVE-2026-101856"],"related":[],"title":"Oracle E-Business Suite: Order Management flaw exposes data to low-privilege network users","description":"Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Order Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","summary":"Oracle E-Business Suite's Order Management product has a flaw in its Product Diagnostic Tools component, affecting versions 12.2.3 through 12.2.15. A low-privileged user with network access over HTTP can gain unauthorized access to order data the product holds.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erp","oracle-ebs","order-management","self-hosted","vendor"],"not_affected_if":["unaffected-release"],"how_to_check":"- Check the installed Oracle E-Business Suite release and the Order Management patch level in the admin console or with `unknown` tooling; the sources do not name a command\n- Confirm whether Order Management is running a release in the 12.2.3 to 12.2.15 range","fix":"- Apply the Oracle Critical Patch Update that addresses CVE-2026-101856 for Oracle E-Business Suite Order Management; the exact patch number is unknown from the sources\n- Move to a release outside the affected range `12.2.3`-`12.2.15` once Oracle publishes it","status":"open","published_at":"2026-10-20T22:18:41+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T03:53:31+00:00","updated_at":"2026-10-25T03:53:31+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:53:31Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update that addresses CVE-2026-101856 for Oracle E-Business Suite Order Management; the exact patch number is unknown from the sources\n- Move to a release outside the affected range `12.2.3`-`12.2.15` once Oracle publishes it","reach":"internet","title":"Oracle E-Business Suite: Order Management flaw exposes data to low-privilege network users","impact":"medium","summary":"Oracle E-Business Suite's Order Management product has a flaw in its Product Diagnostic Tools component, affecting versions 12.2.3 through 12.2.15. A low-privileged user with network access over HTTP can gain unauthorized access to order data the product holds.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","order-management","erp","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Low-privileged users read critical Order Management data over HTTP","analyst_note":"Confirm the Oracle Critical Patch Update number and fixed release from the Oracle security alert, since the sources give only the NVD entry.","how_to_check":"- Check the installed Oracle E-Business Suite release and the Order Management patch level in the admin console or with `unknown` tooling; the sources do not name a command\n- Confirm whether Order Management is running a release in the 12.2.3 to 12.2.15 range","needs_analyst":true,"not_affected_if":["unaffected-release"],"who_is_affected":"Organizations running Oracle E-Business Suite with the Order Management module in the affected 12.2.3 to 12.2.15 range are exposed, since the flaw is reachable over HTTP by any low-privileged account. Teams on unaffected releases or without Order Management can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000673,"input_tokens":3465,"output_tokens":653,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101856':19A,22A '-2026':18A,21A '/av':153C '12.2.15':56B,101C '12.2.3':54B,100C '3.1':143C,152C '6.5':146C 'access':64B,70B,111C,128C,134C,140C 'affect':52B,98C 'allow':105C 'attack':108C,120C 'base':144C 'busi':4A,37B,88C 'complet':133C 'compon':51B,90C 'compromis':115C 'confidenti':147C 'critic':130C 'cve':17A,20A 'cvss':142C,149C,151C 'data':10A,73B,131C,141C 'diagnost':49B,92C 'e':3A,36B,87C 'e-busi':2A,35B,86C 'easili':102C 'eb':26B 'erp':23B 'exploit':103C 'expos':9A 'flaw':8A,45B 'gain':68B 'h/i':159C 'hold':76B 'host':32B 'http':66B,113C 'impact':148C 'l/pr':155C 'l/ui':156C 'low':13A,59B,106C 'low-privileg':12A,58B 'manag':7A,29B,41B,82C,118C,139C 'n':161C 'n/a':160C 'n/ac':154C 'n/s':157C 'network':15A,63B,110C 'oracl':1A,25B,34B,80C,85C,116C,137C 'oracle-eb':24B 'order':6A,28B,40B,72B,81C,117C,138C 'order-manag':27B 'privileg':14A,60B,107C 'product':42B,48B,75B,83C,91C 'result':125C 'score':145C 'self':31B 'self-host':30B 'success':119C 'suit':5A,38B,89C 'support':94C 'tool':50B,93C 'u/c':158C 'unauthor':69B,127C 'user':16A,61B 'vector':150C 'vendor':33B 'version':53B,95C 'via':112C 'vulner':77C,104C,123C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite with the Order Management module in the affected 12.2.3 to 12.2.15 range are exposed, since the flaw is reachable over HTTP by any low-privileged account. Teams on unaffected releases or without Order Management can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101856","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101856","severity":null,"published_at":"2026-10-20T22:18:41+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}