Oracle E-Business Suite Engineering: Authenticated remote compromise in Change Management
Summary
Oracle E-Business Suite Engineering (component Change Management) in supported releases 12.2.3 to 12.2.15 is affected by a flaw that can be exploited over HTTP. An attacker with a low-privileged account and network access can, according to the CVSS vector, gain full control over confidentiality, integrity and availability. Exploitation requires a valid low-privileged login, but many staff accounts in typical deployments can meet that requirement.
Affected
- Oracle E-Business Suite Engineering (component Change Management)
- Supported versions 12.2.3 to 12.2.15
- Exact patch identifiers: Unknown.
Fixed in
- Addressed in the Oracle Critical Patch Update of October 2026 (released 20 October 2026).
- Specific EBS patch numbers: Unknown. See My Oracle Support note KA923 and the Oracle advisory.
Workaround
- No vendor-documented workaround for this CVE is known.
- Restrict access to E-Business Suite and its consoles to required users only, e.g. via VPN or allow-list.
Exploitation
- Exploited in the wild: Unknown (no evidence found in the reviewed sources; re-check CISA KEV).
- Public proof of concept: none found.
- CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Ask your EBS provider or internal team whether any system runs release 12.2.3 to 12.2.15 and whether the October 2026 CPU is applied, including database and middleware layers.
- Obtain the exact patch list from KA923 and the Oracle advisory and apply it without delay.
- Verify that EBS and its consoles are not reachable from the internet unless required.
- Review EBS web and login logs for unusual activity since 20 October 2026.
- Re-check CISA KEV and the Oracle advisory for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory October 2026 www.oracle.com
- VulnCheck/Vulners CVE record CVE-2026-101813 vulners.com
- Strix CVE-2026-101813 www.strix.ai
- Brandefense: Oracle October 2026 CPU brandefense.io
- SecurityOnline: Oracle CPU October 2026 securityonline.info
- BleepingComputer: Hackers scanning for recently patched Oracle flaw www.bleepingcomputer.com
- Help Net Security: Oracle EBS CVE-2026-101767 exploitation www.helpnetsecurity.com
- Oracle EBS Java CPU checker (October 2026) blogs.oracle.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:16.
Original description (NVD)
Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Engineering. Successful attacks of this vulnerability can result in takeover of Oracle Engineering. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.