CVE-2026-101640
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience) affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data and update/insert/delete some data.
Risk Assessment
Successful exploitation can result in unauthorized access and modification of critical data in Oracle Marketing, impacting confidentiality and integrity. It requires no authentication, increasing the risk.
Recommendation
Apply the available Oracle security updates for versions 12.2.3-12.2.15. Restrict network access to Oracle Marketing and monitor for suspicious activity.
Other vulnerabilities in Oracle Marketing
See all- CVE-2026-101639Medium
Vulnerability in Oracle Marketing (component Audience) of Oracle E-Business Suite versions 12.2.3-12.2.15. It allows a low-privileged attacker with network access via HTTP to modify and read some data, but requires human interaction and may impact additional products.
- CVE-2017-10171High
A vulnerability in the Oracle Marketing component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks require human interaction, which may lead to unauthorized access to critical data.
- CVE-2017-3356High
A vulnerability in the Oracle Marketing component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks require human interaction, increasing the risk of unauthorized access to critical data.
- CVE-2017-3355High
A vulnerability in the Oracle Marketing component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise the system. It requires interaction from a person other than the attacker, which can lead to unauthorized access to critical data.
- CVE-2017-3347High
A vulnerability in the Oracle Marketing component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. It requires interaction from a person other than the attacker.
- CVE-2017-3345High
A vulnerability in the Oracle Marketing component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise the system. It requires interaction from a person other than the attacker, potentially leading to unauthorized creation, deletion, or modification of data.
- CVE-2017-3342High
Vulnerability in the Oracle Marketing component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. It requires human interaction from a person other than the attacker.
- CVE-2017-3337High
A vulnerability in the Oracle Marketing component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. It requires human interaction from a person other than the attacker, and attacks may significantly impact additional products.
- CVE-2017-3358High
A vulnerability in the Oracle Marketing component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks require human interaction and may significantly impact additional products.
- CVE-2017-3357High
A vulnerability in the Oracle Marketing component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. It requires human interaction from a person other than the attacker.
Original NVD description (English source)
Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Marketing accessible data as well as unauthorized update, insert or delete access to some of Oracle Marketing accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS