Oracle E-Business Suite Application Object Library: Local compromise via DB privileges
Summary
Oracle E-Business Suite (EBS) Application Object Library versions 12.2.3 through 12.2.15 contain a flaw in the DB Privileges component. An attacker with low privileges and a logon to the infrastructure where the component runs can compromise it, with high impact on confidentiality, integrity and availability. The CVSS score is 7.8 and NVD analysis was still pending at the time of writing.
Affected
- Oracle E-Business Suite Application Object Library 12.2.3 through 12.2.15
Fixed in
- Apply the October 2026 Critical Patch Update (CPU) from Oracle. The exact fixed patch level is unknown.
- Oracle My Oracle Support Note KA923 is referenced for related patches, but its coverage of this CVE is unconfirmed.
Workaround
Unknown.
Exploitation
- No evidence of exploitation in the wild found for this CVE.
- No public proof-of-concept code found.
- EPSS 0.00118 (low predicted exploitation probability).
- A different EBS flaw, CVE-2026-101767, is reported to be probed in the wild. It is not this CVE.
Our recommendation
- Confirm whether Oracle E-Business Suite is in use.
- Inventory versions in the 12.2.3 to 12.2.15 range.
- Apply the October 2026 CPU after verifying the patch set coverage, including KA923 if applicable.
- Restrict and audit operating system and database logons to EBS hosts.
- Monitor for unusual logons on EBS infrastructure.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle October 2026 Critical Patch Update www.oracle.com
- NVD mirror (Vulners) CVE-2026-101566 vulners.com
- CVE record mirror (Vulners) vulners.com
- CNA description mirror (Strix) www.strix.ai
- Rescana on CVE-2026-101767 and KA923 www.rescana.com
- Heise report on CVE-2026-101767 probing www.heise.de
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:26.
Original description (NVD)
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Object Library executes to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.