Oracle Order Management CVE-2026-101538

Exploitation requires a valid low-privilege Oracle E-Business Suite account (PR:L) with network HTTP access to the Oracle Order Management module and its Product Diagnostic Tools component; affected deployments run EBS versions 12.2.3 through 12.2.15. No user interaction is required (UI:N) and complexity is low (AC:L), but the authentication requirement is the primary limiting factor - this cannot be exploited anonymously from the internet, so exposure depends on how broadly low-privilege EBS accounts are provisioned and whether the application tier is network-reachable by those users. Impact is limited to data confidentiality; no integrity or availability effect applies.

This is a moderate-severity, confidentiality-only flaw (CVSS 3.1 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) in the Product Diagnostic Tools component of Oracle Order Management (Oracle E-Business Suite). The vector signals favor an attacker - network reachable over HTTP, low attack complexity, no user interaction - but it is NOT unauthenticated: PR:L means the attacker must already hold a valid low-privilege EBS account, which materially limits opportunistic mass exploitation. Impact is confined to disclosure of critical/all Oracle Order Management data (C:H, with I:N/A:N), so no integrity or availability loss. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization; this reads as a patch-in-normal-cycle item rather than an emergency, though EBS is a high-value target holding sensitive business data. CONFLICT TO RESOLVE: the input Tags include 'Authentication Bypass', which directly contradicts the CVSS PR:L (authentication required) and the description's 'low privileged attacker' - verify with Oracle CPU Oct 2026, as the tag appears mislabeled and should not drive prioritization.

An attacker who already holds a low-privilege Oracle E-Business Suite account sends crafted HTTP requests to the Product Diagnostic Tools functionality of Oracle Order Management and abuses it to read critical business data they should not be able to access. No user interaction or elevated privileges are needed, and attack complexity is low, but valid authentication is a prerequisite. No public exploit code is identified at time of analysis.