Oracle Customer Care CVE-2026-101668

Exploitation requires human interaction from a person other than the attacker (CVSS UI:R) - a user of Oracle Customer Care must be induced to open attacker-supplied content, so this cannot be driven autonomously. No authentication is required of the attacker (PR:N), and the vector is remote over HTTP (AV:N/AC:L). Affected deployments are Oracle E-Business Suite Customer Care versions 12.2.3 through 12.2.15; the scope change (S:C) means successful injection may reach additional EBS products accessible to the victim. The primary limiting factors are the mandatory victim interaction and the partial (Low) confidentiality/integrity impact with no availability impact.

This is a moderate-severity issue (CVSS 3.1 base 6.1) whose vector - AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - is the textbook pattern Oracle assigns to reflected cross-site scripting (XSS): network-reachable, low complexity, no privileges, but requiring victim interaction (UI:R), with a scope change (S:C) and only Low confidentiality and integrity impact and no availability impact. Despite the 'Authentication Bypass' tag in the input, nothing in the description or the CVSS metrics supports an authentication-bypass characterization - the C:L/I:L/A:N + UI:R + S:C combination indicates client-side script injection, not a direct backend auth bypass, so that tag appears mislabeled and should not drive prioritization. No EPSS score, no CISA KEV listing, and no public POC were provided, so real-world exploitation signals are absent. The mandatory human interaction (an administrator or user must be lured into clicking/opening attacker-controlled content) and the merely partial (Low) impact meaningfully reduce real-world risk versus a true unauthenticated RCE; this is a patch-in-normal-cycle item rather than an emergency. Note the limitation: risk assessment rests solely on the Oracle CPU description and the CVSS vector, with no independent exploitation telemetry available.

An attacker crafts a malicious link or payload targeting the Oracle Customer Care (Internal Operations) component and lures an authenticated EBS user into opening it; the injected script executes in the victim's session, and because of the scope change it can affect other Oracle E-Business Suite products the user can reach, enabling limited unauthorized read and limited update/insert/delete of data. No public exploit code was identified at time of analysis, and the attack cannot succeed without that human interaction.