Oracle E-Business Suite Global Order Promising: Unauthorized data access via Web Service
Summary
A flaw in the Web Service component of Oracle E-Business Suite Global Order Promising allows an authenticated low-privileged attacker with HTTP network access to read, modify or delete accessible data. Successful exploitation can also affect other products due to a scope change. The attack is considered highly complex and requires a valid low-privilege account.
Affected
- Oracle E-Business Suite, Global Order Promising, supported versions 12.2.3 to 12.2.15
- CVSS 3.1: 8.2 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N), CWE-284
Fixed in
- Fixed in the Oracle Critical Patch Update of October 2026 (released 20 October 2026)
- Specific patch identifiers for this CVE: Unknown. Check Oracle's advisory and risk matrix.
- Dependent Oracle Database and Fusion Middleware updates from the same CPU should also be applied.
Workaround
- No vendor workaround known.
- Until patched, restrict network access to EBS web services to required users and networks.
- Review which accounts hold Global Order Promising responsibilities.
Exploitation
- No public proof of concept or in-the-wild exploitation known at time of writing.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- EPSS 0.00292.
Our recommendation
- Apply the October 2026 Oracle CPU, including dependent database and middleware updates.
- Check whether EBS web services are reachable from the internet, for example through supplier or customer portals; if so, treat as high priority.
- Restrict access to EBS web services and review Global Order Promising accounts until patched.
- Monitor EBS web service logs for unusual requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory, October 2026 www.oracle.com
- Vulners CVE record CVE-2026-101841 vulners.com
- Vulners NVD record CVE-2026-101841 vulners.com
- Brandefense: Oracle October 2026 CPU brandefense.io
- Breachroad: Oracle CPU October 2026 breachroad.com
- Strix AI: CVE-2026-101841 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:30.
Original description (NVD)
Vulnerability in the Global Order Promising product of Oracle E-Business Suite (component: Web Service). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Global Order Promising. While the vulnerability is in Global Order Promising, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Global Order Promising accessible data as well as unauthorized access to critical data or complete access to all Global Order Promising accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.