Oracle E-Business Suite: Improper access control in Application Object Library
Summary
Oracle E-Business Suite releases 12.2.3 to 12.2.15 contain a flaw in the Application Object Library (DB Privileges component). A low-privileged user with local logon to the application infrastructure can take over Application Object Library, with high impact on confidentiality, integrity and availability (CVSS 7.8). Remote exploitation without a valid account is not described by the CVE data, but the shared core of E-Business Suite makes a compromise significant.
Affected
- Oracle Application Object Library in Oracle E-Business Suite 12.2.3 through 12.2.15
- Supported versions that are affected: 12.2.3-12.2.15
Fixed in
- Fixed in the Oracle Critical Patch Update of October 2026 (released 20 October 2026)
- Exact patch number: Unknown. Check My Oracle Support note KA923 for the EBS Release 12 patch list.
Workaround
- No vendor-documented workaround found.
- Interim control (not a vendor instruction): restrict which accounts can log on to the EBS application and database tiers.
Exploitation
- No exploitation confirmed for this CVE.
- Not listed in the CISA KEV catalog as of 21 October 2026.
- EPSS 0.0016 (very low).
- No public proof of concept found.
Our recommendation
- Apply the October 2026 Critical Patch Update to all EBS 12.2.3-12.2.15 environments, including the Java and database tiers.
- Review and reduce accounts with logon to the EBS application and database tiers.
- Patch internet-facing EBS components first, as other October 2026 AOL and EBS flaws are reachable over HTTP without login and could provide an initial foothold.
- Monitor for unusual privilege changes and logons on EBS servers.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory October 2026 www.oracle.com
- Strix AI CVE-2026-101757 www.strix.ai
- Vulners NVD record CVE-2026-101757 vulners.com
- VulDB entry 423536 vuldb.com
- Brandefense October 2026 CPU overview brandefense.io
- Waratek October 2026 CPU overview waratek.com
- Oracle EBS Java CPU checker blog blogs.oracle.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:24.
Original description (NVD)
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Object Library executes to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.