IT SBIT Services
Schneeberger
DEEN
CVE tracker

Oracle E-Business Suite: Privilege escalation in Document Management Attachments

CVE-2026-101824High 8.7

← All vulnerabilities

Summary

A flaw in the Attachments component of the Document Management and Collaboration product in Oracle E-Business Suite allows an authenticated low-privileged attacker over HTTP to create, delete or modify critical data and gain broad access to accessible data. Exploitation requires a user to interact with the attack and can affect resources beyond the EBS application (scope change). Oracle rates the CVSS 3.1 base score at 8.7 and fixed it in the October 2026 Critical Patch Update.

Affected

  • Oracle E-Business Suite, Document Management and Collaboration (component: Attachments)
  • Versions 12.2.3 to 12.2.15

Fixed in

  • October 2026 Critical Patch Update (released 20 October 2026)
  • Patch details: My Oracle Support Note KA923 (patch number for this CVE: unknown, verify in KA923)
  • Oracle also recommends applying the October 2026 CPU to the Database and Fusion Middleware components used by EBS

Workaround

Unknown.

Exploitation

  • No public proof of concept or exploitation report for this CVE found at time of research
  • Not listed as exploited in CISA KEV at the time of the reviewed sources; recheck CISA KEV
  • Do not confuse with CVE-2026-101767 (separate SQL injection in Application Object Library, reported scanning activity)

Our recommendation

  • Apply the October 2026 Oracle CPU patches for EBS 12.2.3 to 12.2.15 as a priority, using MOS Note KA923 to identify the correct patch
  • Upgrade to a release under Premier or Extended Support if the current version is not supported
  • Check whether the EBS web tier is reachable from the internet and restrict access
  • Monitor EBS logs for unusual attachment uploads, downloads, deletions or modifications
  • Recheck CISA KEV and Oracle's advisory for later exploitation reports

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:20.

Original description (NVD)

Vulnerability in the Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Document Management and Collaboration. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Document Management and Collaboration, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Document Management and Collaboration accessible data as well as unauthorized access to critical data or complete access to all Document Management and Collaboration accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed