Oracle Applications DBA CVE-2026-101683

Exploitation requires the attacker to already hold a low-privileged interactive logon on the infrastructure host where Applications DBA / AD Utilities executes (AV:L, PR:L) - it is NOT remotely or unauthenticated exploitable. The affected component is the AD Utilities feature of the Applications DBA product in Oracle E-Business Suite versions 12.2.3 through 12.2.15; environments outside this range or not running the AD Utilities tooling are not in scope. Limiting factors that reduce real-world risk: Oracle rates the attack as 'difficult to exploit' (AC:H), meaning success depends on specific conditions the attacker cannot fully control, and a pre-existing local account is mandatory, so the realistic threat is a malicious insider or post-foothold privilege escalation rather than external attack.

This is a genuinely high-severity but operationally gated issue rather than a drop-everything emergency. The CVSS 3.1 base score of 7.0 (HIGH) reflects total compromise of the Applications DBA component (C:H/I:H/A:H), but the vector tempers real-world risk substantially: AV:L means the attacker must already have local logon access to the infrastructure where Applications DBA executes, PR:L requires an existing low-privileged account, and AC:H indicates the attack is 'difficult to exploit' per Oracle's own wording, requiring conditions outside the attacker's control. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so all three independent exploitation-likelihood signals are either absent or negative - the signals are consistent (not conflicting) in pointing toward low near-term exploitation probability. The dominant risk driver is therefore insider or post-compromise lateral movement: an attacker who has already gained a foothold on the EBS application tier could escalate to full control of the DBA tooling. Net assessment: a real priority for patching in Oracle EBS environments (especially internet-adjacent or multi-tenant deployments) but NOT a high-urgency, mass-exploitable network threat. Note the input 'Information Disclosure' tag understates impact - the CVSS vector and description describe full takeover (I:H/A:H), not mere disclosure.

An attacker with a low-privileged local account on the Oracle E-Business Suite application tier (for example, a compromised functional user, a malicious insider, or a foothold obtained from a prior intrusion) abuses a flaw in the AD Utilities component of Applications DBA. Because the attack requires local logon and has high complexity, it is not remotely triggerable and would typically chain off an existing compromise. No public exploit code has been identified at time of analysis, so this would require original exploit development.