CVE-2026-101643
HighCVSS 7.1Summary
Vulnerability in the Oracle Sales Online product of Oracle E-Business Suite (component: Internal Operations) affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a low privileged attacker with network access via HTTP to gain unauthorized creation, deletion, or modification access to critical data and unauthorized read access to a subset of data.
Risk Assessment
Successful exploitation can result in unauthorized changes and read access to critical data in Oracle Sales Online, impacting confidentiality and integrity. It requires low privileges but is easily exploitable.
Recommendation
Apply the available Oracle security updates for versions 12.2.3-12.2.15. Restrict network access to Oracle Sales Online and monitor for suspicious activity.
Other vulnerabilities in Oracle Sales Online
See all- CVE-2026-83172High
Vulnerability in Oracle Sales Online (component: OSO Other) of Oracle E-Business Suite. Affected supported versions are 12.2.3-12.2.15. An easily exploitable vulnerability allows a low privileged attacker with network access via HTTP to compromise the system, with potential impact on additional products (scope change).
- CVE-2026-83126High
Vulnerability in the Oracle Sales Online product (Internal Operations component) of Oracle E-Business Suite, affecting versions 12.2.3-12.2.15. A low privileged authenticated attacker with network access via HTTP can compromise Oracle Sales Online, requiring human interaction from a person other than the attacker. The vulnerability may also significantly impact additional products (scope change).
- CVE-2026-83124High
Vulnerability in the Oracle Sales Online product of Oracle E-Business Suite (component: Internal Operations). Affected supported versions are 12.2.3-12.2.15. An easily exploitable vulnerability allows a low privileged attacker with network access via HTTP to compromise Oracle Sales Online.
Original NVD description (English source)
Vulnerability in the Oracle Sales Online product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Online. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Sales Online accessible data as well as unauthorized read access to a subset of Oracle Sales Online accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS