Oracle Capacity CVE-2026-101540

Exploitation requires an authenticated session with at least low-level privileges on an Oracle E-Business Suite instance running Oracle Capacity version 12.2.3 through 12.2.15, with the Capacity / Internal Operations component reachable over HTTP. The attacker does not need high privileges or user interaction, and attack complexity is low. Limiting factors: the attacker must already hold valid EBS credentials (PR:L - this is NOT remote-unauthenticated), and impact is confined to confidentiality (data disclosure) with no integrity or availability effect; the scope change means exposure can extend to data of additional Oracle products hosted by the same EBS deployment. Realistic risk is highest where EBS is internet-facing and low-privilege accounts are broadly provisioned.

This is a moderately-serious, authenticated information-disclosure flaw rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7) tells a consistent story: network-reachable over HTTP, low attack complexity, but it requires low-level privileges (PR:L), so the attacker must already be an authenticated EBS user. Impact is confidentiality-only (C:H, I:N, A:N) with a scope change (S:C), meaning a successful attack can expose data belonging to products beyond Oracle Capacity itself - that scope change is what elevates the score into the High band despite there being no integrity or availability impact. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or probable exploitation: exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent (no CVSS-vs-description conflict), but note a tag discrepancy: the input is tagged 'Authentication Bypass,' which contradicts PR:L - a genuine auth bypass would be PR:N. Treat the 'Authentication Bypass' label as unverified/likely mislabeled; this is a privilege-requiring data-exposure bug, not an unauthenticated bypass. Net: a real patch-this-cycle priority for EBS operators (especially internet-facing deployments), but not a widespread-exploitation crisis absent EPSS/KEV evidence.

A low-privileged but authenticated Oracle E-Business Suite user (or an attacker who has obtained any valid EBS account) sends crafted HTTP requests to the Oracle Capacity / Internal Operations component over the network. Because of the scope change, the request lets them read critical data not only within Capacity but across additional Oracle products the EBS instance exposes. No public exploit code was identified in the provided data, and the low attack complexity (AC:L) means no special timing or race conditions are needed once a valid account is available.