Oracle Application Object Library: Improper access control
Summary
Oracle Application Object Library, the Core component of Oracle E-Business Suite 12.2.3 to 12.2.15, contains an improper access control flaw (CWE-284). An unauthenticated attacker with network access via HTTP can compromise the component, and Oracle describes the possible result as takeover of Application Object Library. Exploitation is difficult (high attack complexity), and Oracle rates the issue CVSS 8.1 (High). No exploitation of this CVE is known, and Oracle E-Business Suite is mainly used by larger mid-sized organisations.
Affected
- Oracle E-Business Suite, Application Object Library (Core component), versions 12.2.3 to 12.2.15
Fixed in
- October 2026 Critical Patch Update (CPU), released 20 October 2026
- Exact patch details: see the Oracle advisory and My Oracle Support Note KA923 (coverage of this CVE not confirmed)
- Fixed version number: Unknown.
Workaround
Unknown. No vendor-documented workaround identified.
Exploitation
- No known exploitation of CVE-2026-101700 as of publication; no public proof of concept found.
- CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
- Related CVE-2026-101767 (same product and versions, CVSS 9.8) is reported as targeted; this does not apply to CVE-2026-101700.
Our recommendation
- Check whether an Oracle E-Business Suite 12.2.x instance exists and which exact version is in use.
- If the version is 12.2.3 to 12.2.15, apply the October 2026 CPU following Oracle's advisory.
- Restrict HTTP access to E-Business Suite from the internet where possible.
- Verify the fix in the Oracle risk matrix and watch for the next CPUs (17 November and 15 December 2026).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Security Alert: October 2026 CPU www.oracle.com
- Oracle Security Blog: October 2026 Critical Patch Update released blogs.oracle.com
- CVE record mirror (Vulners): CVE-2026-101700 vulners.com
- Rescana: Oracle E-Business Suite CVE-2026-101767, KA923 patch table www.rescana.com
- OffSeq Radar: October 2026 CPU, next CPU dates radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:26.
Original description (NVD)
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.