Oracle Applications Manager: Improper access control in Diagnostics

Summary

Oracle Applications Manager, a component of Oracle E-Business Suite, is affected in versions 12.2.3 to 12.2.15, in the Diagnostics component. An attacker with low privileges and network access via HTTP can compromise the application, with a full takeover possible and high impact on confidentiality, integrity and availability. No user interaction is needed, so any valid E-Business Suite account may be enough. NVD analysis was still pending at publication.

Affected

• Oracle Applications Manager (part of Oracle E-Business Suite) 12.2.3 to 12.2.15
• Component: Diagnostics
• CVSS 3.1: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Fixed in

• Fixed through Oracle's October 2026 Critical Patch Update (CPU).
• Patch ID and prerequisite patches: Unknown.
• For E-Business Suite, Oracle's October 2026 CPU points customers to My Oracle Support Note KA923. Confirm that this note covers CVE-2026-101742.

Workaround

• No vendor workaround known.
• Interim measure: restrict network access to Applications Manager and its diagnostics URLs to admin networks or VPN, and review which accounts hold E-Business Suite access.

Exploitation

• No known exploitation of this CVE at the time of research.
• CISA SSVC assessment in the official CVE record: Exploitation none, Automatable no, Technical Impact total.
• Not in the CISA Known Exploited Vulnerabilities catalog as of 21 October 2026 (per source).
• Do not confuse with CVE-2026-101767, a separate E-Business Suite flaw that is being probed.
• No public proof of concept found.

Our recommendation

• Apply the October 2026 CPU patches for E-Business Suite, verify the patch for CVE-2026-101742 in Oracle's advisory and KA923.
• Patch internet-facing or broadly reachable instances first, including test and clone instances.
• Restrict access to Applications Manager and diagnostics URLs to admin networks or VPN until patched.
• Review E-Business Suite accounts and remove unneeded access.
• Monitor logs for unusual HTTP access to Applications Manager.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Oracle Critical Patch Update Advisory - October 2026 www.oracle.com
• CVE record via Vulners (CVELIST) vulners.com
• Strix CVE summary CVE-2026-101742 www.strix.ai
• Rescana: Oracle E-Business Suite and KA923 guidance www.rescana.com
• Brandefense: Oracle October 2026 Critical Patch Update brandefense.io
• SecurityWeek: Hackers start probing fresh Oracle EBS vulnerability www.securityweek.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:17.