What is the CVSS score of CVE-2026-101567?

CVE-2026-101567 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

How to fix or mitigate CVE-2026-101567?

Within 24 hours, inventory every Oracle E-Business Suite instance on releases 12.2.3 through 12.2.15 and confirm which ones run Cost Management/Cost Planning; restrict HTTP access to those endpoints to trusted networks and known administrative hosts, and review low-privilege EBS accounts for unnecessary Cost Planning responsibilities. Within 7 days, implement least-privilege changes to remove Cost Planning access from users who do not need it, enable detailed audit logging and alerting on Cost Planning transactions and privilege changes, and deploy network segmentation or a web application firewall in front of the EBS application tier to limit exposure. Within 30 days, establish a recurring review of Oracle Critical Patch Updates and vendor advisories for a fix covering 12.2.3-12.2.15, test and apply the vendor patch as soon as it is released, and conduct a tabletop exercise or targeted audit of Cost Management activity to validate detection and response.

Oracle Cost Management CVE-2026-101567

EUVD-2026-105975 HIGH

2026-10-20 secalert_us@oracle.com

GHSA-5qm6-82w9-c624

Information Disclosure Oracle

8.8

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate with low-privilege EBS account
Exploit

Send crafted HTTP request to Cost Planning
Execution

Exploit flaw in Oracle Cost Management
Impact

Full takeover of Cost Management module

Vulnerability Assessment

Exploitation Conditions	Exploitation requires a valid low-privileged Oracle E-Business Suite account (CVSS PR:L) with network HTTP access to the Oracle Cost Management application's Cost Planning component; only EBS releases 12.2.3 through 12.2.15 are affected. No user interaction is needed (UI:N) and no special non-default feature or configuration is named by Oracle, so any authenticated low-trust user reaching the module over HTTP can attempt it. The primary limiting factor is the authentication requirement - the attacker must already possess or obtain EBS credentials; unaffected versions and network segmentation isolating the EBS tier from untrusted users further constrain realistic exposure.
Impact	The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) signals a genuine high-priority issue: the attack is network-reachable over HTTP, low in complexity, and Oracle's own text explicitly calls it 'easily exploitable' resulting in full 'takeover' of Oracle Cost Management, with high impact across confidentiality, integrity, and availability. The one meaningful barrier is PR:L - a low-privileged but authenticated EBS account is required, so this is not a pre-auth internet-worm scenario; it is most dangerous where many low-trust users already hold EBS credentials or where credentials can be phished/obtained. No EPSS exploitation-probability score, CISA KEV listing, SSVC decision data, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization at this time - the risk ranking rests on severity and ease-of-exploit rather than observed in-the-wild activity. Note a signal conflict worth flagging: the input Tag labels this 'Information Disclosure,' but the CVSS vector and Oracle's 'takeover' wording indicate full C/I/A compromise, so the tag materially understates the impact and should not be used to deprioritize. Because Oracle is the sole reporting source, affected-version and fix data are vendor-confirmed but unvalidated by third parties.
Exploit ScenarioDerived	An attacker who holds any low-privilege Oracle E-Business Suite account (or has phished one) sends crafted HTTP requests to the Cost Planning component of Oracle Cost Management. Because the flaw is low-complexity and requires no user interaction, the request escalates the attacker to full control ('takeover') of the Cost Management module, exposing and altering costing data. No public exploit code was identified in the provided data.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 21, 2026

Oracle Cost Management, a module of Oracle E-Business Suite (releases 12.2.3 through 12.2.15), permits a low-privileged authenticated attacker with HTTP network access to fully compromise the Cost Planning component, resulting in high confidentiality, integrity, and availability impact. Oracle's own advisory characterizes the flaw as easily exploitable and capable of leading to takeover of the module, yielding a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The practical barrier is authentication: the attacker must already hold valid low-privilege EBS credentials, and no public exploit code or confirmed active exploitation was identified at time of analysis.

RemediationAI

Apply the Oracle Critical Patch Update fixes published in the October 2026 CPU (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the authoritative remediation for EBS 12.2.3-12.2.15; an exact patched build number is not specified in the provided data, so confirm the minimum patch level in the CPU advisory before closing the finding. Until patching is complete, compensating controls include restricting network access to the Cost Planning module so only trusted administrative subnets can reach it (reduces exposure but complicates legitimate remote use), tightening the assignment of EBS responsibilities so Cost Planning menus/functions are not granted to broad low-privilege user populations (reduces attack surface but may disrupt existing workflows), and monitoring EBS application logs for anomalous Cost Planning activity from low-privileged accounts. Because exploitation requires valid credentials, enforcing strong authentication, MFA where supported, and prompt revocation of dormant accounts materially raises the bar. No vendor-released patch identifier beyond the CPU advisory and no public exploit code were identified at time of analysis.

Affected VersionsENISA

Oracle Cost Management 12.2.3 ≤12.2.15

Affected Packages

euvd oracle_cost_management no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability resides in the Cost Planning component of Oracle Cost Management within Oracle E-Business Suite, a large enterprise resource planning suite typically deployed on application servers fronted by Oracle HTTP Server or similar web tiers. The root cause class is not disclosed (no CWE assigned), but the CVSS vector AV:N/AC:L/PR:L/UI:N/S:U with all three impact metrics rated High indicates a missing authorization or insufficient access-control check that lets an authenticated low-privileged user reach functionality or data reserved for higher-privileged roles. Because scope is unchanged (S:U), the compromise remains within the Cost Management security context rather than escalating to the host or other components. No special non-default configuration or user interaction is required, so any valid EBS account able to reach the Cost Planning module over HTTP can attempt exploitation.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 8.8 HIGH

Network HTTP vector and vendor's 'easily exploitable' give AV:N/AC:L; a low-privileged EBS account is required so PR:L, UI:N; 'takeover' yields C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive ViewAI

Why It Matters

Oracle E-Business Suite 12.2.3-12.2.15 Cost Management module exposes a high-severity flaw (CVE-2026-101567) that lets an authenticated low-privileged user with HTTP access take full control of the Cost Planning component, threatening the confidentiality, integrity, and availability of cost and financial data. Because exploitation requires valid EBS credentials, the primary risk is from compromised or malicious internal accounts rather than anonymous outsiders. Security leadership should prioritize inventorying affected instances, tightening access, and preparing for a vendor fix, as no patch or public exploit is currently identified.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to Cost Management/Cost Planning HTTP endpoints via segmentation or WAF; enforce least privilege by removing Cost Planning responsibilities from low-privilege accounts that do not require them; enable and monitor audit logs for Cost Planning transactions and privilege changes; review and rotate credentials for EBS accounts with Cost Management access; and maintain heightened monitoring for anomalous cost planning activity.

Threat Intelligence Overview

EPSS Score

0.5%

Top 60% exploitable

Prevalence

Medium

Oracle EBS ERP module; common in large enterprises, not ubiquitous

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.5%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.