CVE-2026-101849
HighCVSS 7.6Summary
Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Create Item Instance). Supported versions affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Installed Base, requires human interaction and may significantly impact additional products (scope change).
Risk Assessment
Can result in unauthorized access to critical data or complete access to all Installed Base accessible data as well as unauthorized update, insert or delete access to some data. Impacts confidentiality and integrity, potentially affecting additional products.
Recommendation
Apply available Oracle security updates for versions 12.2.3-12.2.15. Restrict network access to the component and enforce least privilege.
Other vulnerabilities in Oracle E-Business Suite
See all- CVE-2026-91496High
Vulnerability in the Workflow Notification Mailer component of Oracle E-Business Suite Workflow. A low privileged attacker can exploit it over the network via HTTP to take over Workflow; exploitation is difficult. CVSS 7.5.
- CVE-2026-87357High
Vulnerability in the Order Capture product of Oracle E-Business Suite (component: Internal Operations) affects versions 12.2.3-12.2.15. An easily exploitable flaw allows a high-privileged attacker with network access via HTTP to compromise Order Capture.
- CVE-2026-87356High
Vulnerability in the Applications Platform Engineering product of Oracle E-Business Suite (component: Valid Session) affects versions 12.2.3-12.2.15. An easily exploitable flaw allows a low-privileged attacker with logon access to the infrastructure to compromise Applications Platform Engineering.
- CVE-2026-83370High
Vulnerability in the Sourcing product of Oracle E-Business Suite (component: Auctions) affecting versions 12.2.3-12.2.15. A difficult to exploit flaw allows a low privileged attacker with network access via HTTP to compromise Sourcing.
- CVE-2026-83367High
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events) affecting versions 12.2.3-12.2.15. A difficult to exploit flaw allows an unauthenticated attacker with network access via Oracle Net to modify or delete critical data and gain unauthorized access to it.
- CVE-2026-83366High
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events) affecting versions 12.2.3-12.2.15. A difficult to exploit flaw allows an unauthenticated attacker with network access via HTTP to modify or delete critical data and gain unauthorized access to it.
- CVE-2026-83363High
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO) affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a low privileged attacker with network access via HTTP to compromise the product.
- CVE-2026-83361High
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO) affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a low privileged attacker with network access via HTTP to modify or delete critical data and gain unauthorized access to it.
- CVE-2026-101851High
Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Data Provider UI), affecting versions 12.2.3-12.2.15. An easily exploitable vulnerability allows a low privileged attacker with network access via HTTP to compromise Installed Base.
- CVE-2026-101847High
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). Supported versions affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material.
Original NVD description (English source)
Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Create Item Instance). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Installed Base. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Installed Base, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Installed Base accessible data as well as unauthorized update, insert or delete access to some of Installed Base accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS