Oracle E-Business Suite Partner Management: Unauthorized data access and modification
Summary
A flaw in the Partner Management module of Oracle E-Business Suite 12.2.3 to 12.2.15 allows an authenticated attacker with low privileges to access, modify or delete critical data over HTTP. The attacker can also cause a partial denial of service, and the impact can extend beyond the module (scope change). Exploitation is difficult (high attack complexity) and requires a valid user account.
Affected
- Oracle E-Business Suite, Partner Management (component: Internal Operations)
- Supported versions 12.2.3 to 12.2.15
Fixed in
- October 2026 Critical Patch Update (published 20 October 2026)
- Specific patch ID for Partner Management: Unknown. Check My Oracle Support.
Workaround
- Unknown. No workaround found in the sources.
- Interim measure (analysis, not from a source): disable or restrict the Partner Management module if it is not used.
Exploitation
- No reports of exploitation or public proof-of-concept for this CVE found.
- Oracle's SSVC assessment: Exploitation none, not automatable, total technical impact.
- A different EBS flaw (CVE-2026-101767) from the same patch cycle is being probed.
Our recommendation
- Check whether Oracle Partner Management is licensed and in use.
- Apply the October 2026 Critical Patch Update via the normal EBS patch cycle and verify the patch set on My Oracle Support.
- If the module is in use and the EBS web tier is reachable from the internet, prioritise the patch.
- Restrict network access to the EBS web tier and review accounts with low privileges.
- Monitor EBS logs for unusual access to Partner Management.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle October 2026 CPU www.oracle.com
- NVD mirror (Vulners) vulners.com
- Strix CVE record www.strix.ai
- Positive Technologies PT-2026-119328 vulners.com
- SecurityWeek: probing of CVE-2026-101767 www.securityweek.com
- Oracle Partner Management (EBS overview) www.oracle.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:16.
Original description (NVD)
Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Partner Management. While the vulnerability is in Oracle Partner Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Partner Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Partner Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Partner Management. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.