Skip to content
NewA calmer, faster ZeroHour
Vulnerability3

CVE-2026-101767

Missing authentication in Oracle E-Business Suite Application Object Library

CVSS 3.1
9.8 critical
EPSS
—
Published
·
Modified
Analyze CVE-2026-101767 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

A flaw in the Core component of Oracle Application Object Library (Oracle E-Business Suite) lets an unauthenticated attacker with network access over HTTP compromise the product. No user interaction is required. Successful attacks can take over Oracle Application Object Library. Supported releases 12.2.3 through 12.2.15 are affected.

What to do: Apply Oracle's security update that addresses CVE-2026-101767 for E-Business Suite 12.2.3-12.2.15. Oracle has not listed a fixed version number.

ProductAffected
Oracle Application Object Library (Oracle E-Business Suite)12.2.3-12.2.15
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Weakness
CWE-287, CWE-306
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD CVE.org GitHub PoCs EPSS (—)

In the news

2 stories