Oracle Partner Management CVE-2026-101650

Exploitation requires an authenticated low-privileged account on Oracle Partner Management (PR:L) and network HTTP access to the Internal Operations component; affected deployments are Oracle E-Business Suite Partner Management versions 12.2.3 through 12.2.15. No user interaction is required (UI:N) and attack complexity is low (AC:L). The primary limiting factor is the need for valid credentials/a session on the EBS instance - a purely anonymous external attacker cannot exploit this without first obtaining such access - which makes internet-exposed EBS instances with weak account controls the realistic exposure surface.

This is a genuine medium-to-high priority patch item for organizations running Oracle E-Business Suite, but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, score 7.1) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, yielding high integrity impact (unauthorized create/delete/modify of critical data) plus a partial availability impact; there is no confidentiality impact (C:N). Crucially, PR:L means a valid low-privileged account is required, so this is an authenticated attack rather than a fully anonymous internet-facing one, which materially limits mass exploitation. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. No SSVC decision data was supplied. The signals are internally consistent (network vector aligns with HTTP access described in the text), with the main caveat being that the authentication requirement depends on an attacker first obtaining a low-privileged EBS/Partner Management account.

An attacker who holds or phishes a low-privileged Oracle Partner Management account sends crafted HTTP requests to the Internal Operations component, abusing insufficient authorization checks to create, modify, or delete critical Partner Management data and degrade availability. No user interaction or high privileges are needed, but a valid authenticated session is required. No public exploit code was identified at time of analysis.