Oracle E-Business Suite CVE-2026-101566

The attacker must have an authenticated local logon to the infrastructure/host where Oracle Application Object Library executes and must hold at least a low-privileged account (PR:L, AV:L) - this is not remotely exploitable over the network and cannot be triggered by an unauthenticated outsider. Affected deployments are Oracle E-Business Suite running Application Object Library versions 12.2.3 through 12.2.15; the DB Privileges component is the exploited surface. The key limiting factors are the mandatory local/host foothold and existing valid credentials, which confine realistic exploitation to insiders or post-compromise lateral movement rather than direct external attack.

This is a genuinely high-severity flaw but not an emergency-tier one based on current signals. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) is internally consistent with the description: exploitation requires local logon to the infrastructure where Oracle Application Object Library runs, is low-complexity, and needs a low-privileged account - but yields full compromise (complete C/I/A loss, 'takeover'). The AV:L requirement is the single biggest risk-limiter: an attacker must already have an authenticated foothold on the EBS host, so this is a privilege-escalation / post-access impact amplifier rather than a remotely-reachable entry point. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation or weaponization - this reads as a priority-to-patch item for internal/insider and lateral-movement threat models rather than a perimeter-facing crisis. Note a mild tension: the input Tags label this 'Information Disclosure', yet the CVSS and description describe full takeover (I:H/A:H), so the confidentiality-only framing understates the actual integrity and availability impact - rely on the CVSS vector, not the tag.

An attacker who has already obtained a low-privileged account on the Oracle E-Business Suite host (e.g., a compromised application or OS-level user) abuses the DB Privileges component of Oracle Application Object Library to escalate to full control of the module. Because attack complexity is low and no user interaction is needed, a single authenticated local session is sufficient to achieve complete takeover. No public exploit code was identified in the provided data.