Oracle Capacity CVE-2026-101541

Exploitation requires the attacker to hold a valid low-privileged account on Oracle E-Business Suite with network HTTP access to the Oracle Capacity product's Internal Operations component (affected versions 12.2.3 through 12.2.15). No user interaction and no elevated privileges are needed, and attack complexity is low. The primary limiting factor is the PR:L authentication requirement - an attacker must already possess at least minimal EBS credentials - so internet-exposed EBS instances with weak or widely-distributed low-level accounts are most at risk, while properly segmented, credential-controlled deployments substantially reduce exposure. The scope change means successful access can extend to data in other Oracle EBS products beyond Capacity.

This is a genuine mid-to-high priority issue but not an emergency based on current signals. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with a scope change amplifying impact beyond Oracle Capacity into other Oracle E-Business Suite products - the scope change is the main driver of the elevated score. Impact is confidentiality-only (C:H, I:N, A:N): attackers can read critical/all Capacity-accessible data but cannot modify data or disrupt availability. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is currently no evidence of active or imminent exploitation - this reads as a credential-gated information-disclosure flaw rather than a widely-weaponized target. One conflict to verify: the input Tag 'Authentication Bypass' contradicts the CVSS PR:L requirement (the vector requires an authenticated low-privileged account, which is the opposite of bypassing authentication) - the vector should be treated as authoritative over the tag. Because PR:L requires valid (even low-level) EBS credentials, real-world risk is meaningfully lower in environments with strong access controls and no exposed/guessable low-privilege accounts.

A low-privileged but authenticated Oracle E-Business Suite user (or an attacker who has obtained any valid low-level account) sends crafted HTTP requests to the Oracle Capacity component's Internal Operations endpoints. Because the vulnerability carries a scope change, the resulting unauthorized data access can extend beyond Capacity to other Oracle EBS products, exposing critical business data. No public exploit code is identified at time of analysis, and the attack requires network access plus valid low-privilege credentials.