---
id: "CVE-2026-101856"
kind: "vulnerability"
aliases: ["CVE-2026-101856"]
title: "Oracle E-Business Suite: Order Management flaw exposes data to low-privilege network users"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["erp", "oracle-ebs", "order-management", "self-hosted", "vendor"]
not_affected_if: ["unaffected-release"]
published_at: "2026-10-20T22:18:41+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-25T03:53:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101856", "first_seen_at": "2026-10-23T21:57:23+00:00"}]
---

# Oracle E-Business Suite: Order Management flaw exposes data to low-privilege network users

Oracle E-Business Suite's Order Management product has a flaw in its Product Diagnostic Tools component, affecting versions 12.2.3 through 12.2.15. A low-privileged user with network access over HTTP can gain unauthorized access to order data the product holds.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Oracle E-Business Suite release and the Order Management patch level in the admin console or with `unknown` tooling; the sources do not name a command
- Confirm whether Order Management is running a release in the 12.2.3 to 12.2.15 range

## Fix

- Apply the Oracle Critical Patch Update that addresses CVE-2026-101856 for Oracle E-Business Suite Order Management; the exact patch number is unknown from the sources
- Move to a release outside the affected range `12.2.3`-`12.2.15` once Oracle publishes it

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101856

## From the sources

Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Order Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_