Oracle Capacity CVE-2026-101542

Exploitation requires network access to the Oracle Capacity module (Internal Operations component) of Oracle E-Business Suite over HTTP, plus a valid low-privileged authenticated session (CVSS PR:L) - it is NOT pre-authentication. Affected deployments are Oracle E-Business Suite versions 12.2.3 through 12.2.15 running the Capacity product. The limiting factors are the authentication requirement (any low-privileged EBS account suffices, so this is a modest barrier in multi-user ERP environments) and the need for the Capacity module to be deployed and network-reachable; no special non-default configuration or user interaction is required per the CVSS vector.

This is a genuinely high-priority vulnerability by signal strength, though not yet at emergency level absent exploitation evidence. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) indicates network-reachable exploitation over HTTP, low attack complexity, no user interaction, and only low-level privileges required, with full confidentiality, integrity, and availability impact - Oracle explicitly describes 'takeover of Oracle Capacity.' The only meaningful barrier is PR:L: an attacker needs some authenticated foothold (any low-privileged EBS account), which raises the bar versus a pre-auth flaw but is realistic given the broad user base of ERP systems and credential-phishing/reuse exposure. No EPSS score, CISA KEV listing, public POC, or SSVC decision data was provided, so there is no public exploit identified at time of analysis and no confirmed active exploitation. The risk signals are thus internally consistent (easily exploitable per Oracle + low-complexity CVSS) but one-sided: real-world exploitation likelihood cannot be quantified without EPSS/KEV. Treat as a priority patch in the Oracle October 2026 CPU cycle given Oracle EBS's status as a high-value target, while noting the authentication requirement tempers the mass-exploitation scenario.

An attacker who holds or obtains any low-privileged Oracle E-Business Suite account (via phishing, credential reuse, or an insider) sends crafted HTTP requests to the Oracle Capacity module's Internal Operations component. Because the flaw is easily exploitable with no user interaction, the attacker escalates to full compromise ('takeover') of Oracle Capacity, gaining high confidentiality, integrity, and availability impact. No public exploit code was identified at time of analysis, so exploitation would currently require independent development.