Oracle E-Business Suite CVE-2026-101682

Exploitation requires the attacker to already have logon access to the infrastructure/host where Oracle E-Business Suite Applications DBA (AD Utilities component) executes - this is a local vector (AV:L), not remote network reach, which is the primary limiting factor. Additionally, successful attacks require human interaction from a person other than the attacker (UI:R), meaning a separate privileged user (such as a DBA or operator) must perform an action (e.g., invoke the affected AD Utilities operation) for the attack to succeed. No prior authentication to the EBS application itself is required (PR:N). Affected deployments are limited to EBS versions 12.2.3 through 12.2.15 running the Applications DBA product; environments outside this range or without local multi-user access to the EBS host are not exposed.

This is a genuine but second-tier priority rather than a drop-everything emergency. The CVSS 3.1 base score of 7.8 (HIGH) is driven by full technical impact (C:H/I:H/A:H, resulting in takeover of Applications DBA) and low attack complexity (AC:L), but it is significantly tempered by two gating metrics: AV:L means the attacker must already have local logon access to the host where Applications DBA runs (not remote/network reach), and UI:R means successful attacks require human interaction from a person other than the attacker (e.g., a DBA/operator). PR:N indicates no prior authentication to the application itself is needed, but this is not the same as remote-unauthenticated reach - the local-access prerequisite is the real limiter. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no public exploit code was provided, so exploitation status is 'no public exploit identified at time of analysis.' There is no conflict between the CVSS vector and the description - both consistently describe a local-access, user-interaction-dependent flaw. Net: the combination of required local foothold plus required victim interaction makes mass/automated exploitation unlikely, placing this below network-facing unauthenticated EBS flaws in urgency, though it remains a legitimate privilege/takeover risk in multi-user or shared EBS infrastructure.

An attacker who already holds a low-level local account (or shell) on the server running Oracle E-Business Suite Applications DBA plants or manipulates AD Utilities content, then waits for or socially engineers a DBA/operator into running the affected utility. When that privileged person interacts with the crafted input, the attacker gains full control (confidentiality, integrity, and availability) over Applications DBA. No public proof-of-concept exploit was identified at the time of analysis.