Oracle Partner Management CVE-2026-101651

Exploitation requires an authenticated low-privileged account on the Oracle Partner Management product within Oracle E-Business Suite (CVSS PR:L), reachable over HTTP, targeting the Internal Operations component on affected versions 12.2.3 through 12.2.15. No user interaction is needed (UI:N) and no special non-default configuration is cited in the description. The primary limiting factor is the authentication requirement: the attacker must already possess valid, if minimal, application credentials, which narrows the realistic threat to internal users, partners, or holders of compromised low-privilege accounts rather than anonymous internet attackers.

The CVSS 3.1 base score of 6.5 (Medium) is driven entirely by confidentiality impact (C:H/I:N/A:N) with a network vector, low attack complexity, and crucially PR:L - meaning a low-privileged authenticated attacker, NOT an unauthenticated one. This directly contradicts the input 'Authentication Bypass' tag: the CVSS vector requires the attacker to already hold valid low-privilege credentials on the Oracle Partner Management application, so the realistic threat is a malicious or compromised internal/partner account rather than a fully anonymous external attacker. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation or weaponization - this is 'no public exploit identified at time of analysis.' Net assessment: a credible but not top-tier priority. It is a real risk for Oracle EBS operators because EBS is broadly deployed and low-privilege/partner accounts are common, but the authentication requirement and confidentiality-only impact place it below critical unauthenticated RCE-class issues. The 'Authentication Bypass' tag conflicts with PR:L and should be verified - if the flaw genuinely allows bypassing authentication, the real-world severity would be higher than the vector suggests.

A low-privileged user (e.g. a partner-portal or internal EBS account holder) sends crafted HTTP requests to the Oracle Partner Management Internal Operations component and leverages the flaw to read data they are not authorized to see, resulting in disclosure of or complete access to all Partner Management data. The network vector and low attack complexity make exploitation straightforward once credentials are held, though no public exploit code is currently known.