Oracle E-Business Suite CVE-2026-101638

Exploitation requires (1) an authenticated low-privileged local account (PR:L) with logon to the infrastructure/host where Oracle E-Business Suite Applications DBA (AD Utilities component) executes - there is NO remote network vector (AV:L), and (2) interaction from a separate person other than the attacker (UI:R), i.e. a legitimate administrator or operator must perform an action such as running an AD Utilities command that processes attacker-influenced input. These two factors - local authenticated access and dependence on a distinct victim action - are the primary limiters: the flaw cannot be triggered remotely, anonymously, or without a second human in the loop, which is why it is realistic mainly as an insider or post-compromise escalation path on EBS 12.2.3-12.2.15.

This is a genuinely serious but access-constrained vulnerability, not a drop-everything internet-facing emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, base 7.3) is internally consistent and points to full compromise (C:H/I:H/A:H = takeover of Applications DBA) but only for an attacker who already has a local, authenticated foothold (AV:L, PR:L) on the host where Applications DBA executes, AND who can induce a separate human (UI:R) to perform an action. These two gating conditions substantially reduce real-world exploitability versus a remote unauthenticated flaw of the same score. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no evidence of active or imminent exploitation; absence of these signals is expected for a freshly disclosed Oracle Critical Patch Update item and should not be read as 'safe.' One data conflict to note explicitly: the input Tags label this 'Information Disclosure,' but the CVSS vector and description both assert full Confidentiality, Integrity, AND Availability impact (takeover), so the tag understates the actual impact - treat this as a privilege-escalation/takeover issue, not mere disclosure. Overall priority: medium-high for organizations running the affected EBS 12.2.x versions, driven by insider-threat and chained-attack scenarios rather than mass internet exploitation.

A low-privileged user with a valid local login on the Oracle E-Business Suite application tier stages malicious input or a crafted artifact that is later processed by AD Utilities. When a legitimate administrator or operator runs the affected AD Utilities operation, the attacker's payload executes in the Applications DBA context, yielding full takeover. No public exploit code was identified at time of analysis, and the local access plus required victim interaction make this most realistic as an insider or post-foothold escalation.