Oracle E-Business Suite CVE-2026-101700

Exploitation targets the Core component of Oracle Application Object Library within Oracle E-Business Suite, versions 12.2.3 through 12.2.15, reachable over HTTP. No authentication is required (CVSS PR:N) and no user interaction is needed (UI:N), so a remote unauthenticated attacker can attempt it against an exposed EBS web tier. The key LIMITING factor is Attack Complexity: High (AC:H) - Oracle explicitly describes it as 'difficult to exploit,' indicating the attacker must meet preconditions beyond their direct control (e.g., specific timing, environmental state, or configuration) rather than firing a single reliable request. Exposure is further bounded to the specific 12.2.x release range; 12.1 and 12.2.16+ (if patched) are outside the stated affected set.

This is a genuinely high-priority flaw rather than an inflated CVSS score, but with an important mitigating signal. The CVSS 3.1 base score of 8.1 reflects a network-reachable (AV:N), unauthenticated (PR:N), no-user-interaction (UI:N) vulnerability that yields full takeover - Confidentiality, Integrity and Availability all rated High. The single factor pulling the score down from critical is Attack Complexity: High (AC:H), meaning Oracle itself characterizes it as 'difficult to exploit,' typically requiring conditions outside the attacker's direct control or significant preparation/reconnaissance. No EPSS score was provided, so exploitation probability cannot be quantified from this data. The CVE is NOT listed in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. No SSVC decision data was supplied. Net assessment: the combination of unauthenticated network access and total system takeover on a high-value ERP platform makes this a strong patching priority, but the AC:H rating and absence of any public PoC or active-exploitation evidence suggest the real-world threat is not yet 'drop everything' - it is a priority for Oracle EBS operators to apply the October 2026 CPU, not an emergency driven by observed mass exploitation. Note a metadata conflict: the input Tags label this 'Information Disclosure,' yet the CVSS vector and description describe full C/I/A takeover - the tag understates the impact and should not be relied upon.

An unauthenticated attacker with network reachability to an internet-facing or internally-exposed Oracle E-Business Suite instance sends crafted HTTP requests to the Oracle Application Object Library Core component, exploiting the flaw to gain complete control of the application. Because Attack Complexity is High, the attacker likely needs to satisfy non-trivial preconditions or win a race/timing/configuration-dependent condition before the request succeeds. No public proof-of-concept exploit is identified at time of analysis.