Oracle Capacity CVE-2026-101543

Exploitation requires an authenticated low-privileged account (PR:L) on the target Oracle E-Business Suite instance plus network access to the Oracle Capacity module's Internal Operations component over HTTP; only versions 12.2.3 through 12.2.15 are affected. The high attack complexity (AC:H, Oracle's 'Difficult to exploit') means success depends on satisfying specific, non-default preconditions in the request/processing path that are not publicly documented, so reliable exploitation is not trivial. Limiting factors for defenders: the mandatory valid account (no unauthenticated path), the high-complexity conditions, and the bounded 12.2.x version range - instances outside that range or not exposing the Capacity module to the attacker's network segment are not at risk.

The supplied CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5 HIGH) is the only machine-scored signal available - no EPSS probability, no CISA KEV entry, and no POC were provided, and no SSVC decision data accompanies this record. The vector itself tells a mixed story: the vulnerability is network-reachable over HTTP (AV:N) and needs no user interaction (UI:N), but it carries high attack complexity (AC:H) and requires an already-authenticated low-privileged account (PR:L), which materially lowers real-world exploitability. Oracle's own 'Difficult to exploit' wording is consistent with AC:H. Full C/I/A high impact ('takeover of Oracle Capacity') is what drives the 7.5 rather than any ease of attack. Net assessment: this is a genuine but second-tier priority - the high impact justifies patching in the normal Oracle Critical Patch Update cycle, but the combination of required authentication plus high complexity and the absence of any exploitation evidence argues against emergency out-of-band action. Exploitation status is: no public exploit identified at time of analysis. Note a conflict in the input metadata: the 'Information Disclosure' tag understates a vulnerability whose CVSS shows full integrity and availability compromise (takeover), so defenders should not treat this as read-only data leakage.

An attacker who already holds a low-privileged, authenticated account on an internet- or intranet-reachable Oracle E-Business Suite instance sends crafted HTTP requests to the Oracle Capacity component's Internal Operations interface. By chaining the specific, non-trivial conditions that make this flaw hard to exploit, they escalate to full compromise ('takeover') of the Oracle Capacity module, gaining confidentiality, integrity, and availability control. No public exploit code is known at this time, so successful exploitation currently requires original research into the vulnerable code path.