Oracle E-Business Suite Applications DBA: Improper access control
Summary
Oracle E-Business Suite Applications DBA (component AD Utilities), supported versions 12.2.3 to 12.2.15, contains an improper access control flaw (CWE-284). An attacker with a logon on the infrastructure where Applications DBA runs can take over the product, with high impact on confidentiality, integrity and availability (CVSS 7.8). The attack requires a user other than the attacker to take an action, and the vector is local, so network exposure alone is not sufficient.
Affected
- Oracle E-Business Suite, Applications DBA (AD Utilities component)
- Supported versions 12.2.3 to 12.2.15
- Versions outside this range: Unknown.
Fixed in
- Fixed in Oracle's October 2026 Critical Patch Update (CPU), released 20 October 2026
- Specific patch number for this CVE: Unknown. Check the Oracle advisory and My Oracle Support Note KA923.
Workaround
- No workaround documented by Oracle.
- Interim measure (own analysis, not a vendor statement): restrict interactive logon to hosts running Applications DBA to the administrators who need it, and review who has shell access.
Exploitation
- No public proof of concept or in-the-wild exploitation found.
- Not listed in the CISA Known Exploited Vulnerabilities catalog as of 21 October 2026; re-check before acting.
- Related but separate: CVE-2026-101767 (Application Object Library, CVSS 9.8) is reportedly being scanned for by threat actors.
Our recommendation
- Apply the October 2026 Oracle CPU to Applications DBA and the related EBS layers, after checking the advisory and KA923 for the exact patch.
- Prioritise CVE-2026-101767 in the same patch window.
- Limit and review logon and shell access to Applications DBA hosts until patched.
- Monitor administrative logons and changes on these hosts.
- Check whether your organisation runs EBS 12.2.3 to 12.2.15.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update October 2026 www.oracle.com
- NVD entry via Vulners vulners.com
- Oracle EBS CPU October 2026 check (Nessus) vulners.com
- Hackers scanning for recently patched Oracle flaw (BleepingComputer) www.bleepingcomputer.com
- Oracle October 2026 CPU analysis (Waratek) waratek.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:25.
Original description (NVD)
Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.