Oracle One-to-One Fulfillment CVE-2026-101699

Exploitation requires an authenticated low-privileged account on the target Oracle E-Business Suite instance (PR:L) with network HTTP reachability to the Oracle One-to-One Fulfillment Documents component on affected releases 12.2.3 through 12.2.15. Oracle explicitly rates the vulnerability as 'difficult to exploit' (AC:H), meaning success depends on additional attacker-uncontrolled conditions beyond simply sending a request; no end-user interaction is required (UI:N). The key limiting factors are the need for valid credentials and the high attack complexity, which together substantially reduce the pool of capable attackers and make opportunistic exploitation unlikely even though the vector is network-based.

Signals are mixed and lean toward a moderate, not urgent, priority. The CVSS 3.1 base score is 7.5 (High) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H: the attack is over the network via HTTP (AV:N) with no user interaction (UI:N) and full confidentiality, integrity and availability impact (C:H/I:H/A:H, described as 'takeover'), but two factors restrain real-world risk - high attack complexity (AC:H, Oracle explicitly calls it 'Difficult to exploit') and the requirement for existing low-level privileges (PR:L, an authenticated EBS account). No EPSS score, CISA KEV listing, or public proof-of-concept is present in the provided data, so there is no evidence of active or imminent exploitation. There is no actual signal-to-signal conflict: a high-impact but hard-to-exploit, authentication-gated flaw with no exploitation intelligence is consistent across sources. One metadata inconsistency should be noted: the 'Information Disclosure' tag understates the stated full-takeover (C:H/I:H/A:H) impact. CWE is N/A and no SSVC/EPSS data was supplied, so automatability and exploitation-maturity cannot be scored - treat this as a standard Oracle quarterly CPU patch item to be remediated on normal enterprise patch cadence rather than an emergency.

An attacker who already holds a low-privileged, authenticated account on an Oracle E-Business Suite deployment sends specially crafted HTTP requests to the One-to-One Fulfillment Documents component to abuse the flaw and escalate to full compromise of the module. The high attack complexity means the attacker must satisfy additional non-trivial conditions (e.g., specific timing, state, or configuration), making opportunistic mass exploitation unlikely. No public exploit identified at time of analysis, so any attack would currently require independent vulnerability research.