EUVD-2026-106158
GHSA-vf6v-gvhr-7j2c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged logon to EBS infrastructure
-
DeliveryTarget DB Privileges component of Application Object Library
-
ExploitAbuse privilege flaw locally
-
ExecutionEscalate to full takeover
-
ImpactCompromise confidentiality, integrity and availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess a low-privileged account with interactive logon access to the server infrastructure on which Oracle Application Object Library (Oracle E-Business Suite) runs - this is local, authenticated access, not remote network access. The flaw is reached through the DB Privileges component. Affected deployments are Oracle Application Object Library versions 12.2.3 through 12.2.15. Limiting factors: the AV:L/PR:L vector means a remote, unauthenticated attacker cannot exploit this directly; the attacker needs both network/host logon to the EBS infrastructure and valid (if low-privilege) credentials, which constrains realistic exploitation to insiders or attackers who have already gained a foothold. |
| Impact | This is a credible but not emergency-level priority. The CVSS 3.1 base score of 7.8 (High) is driven by full Confidentiality, Integrity and Availability impact (C:H/I:H/A:H) resulting in complete takeover of Oracle Application Object Library. However, the vector is bounded by AV:L (local - the attacker must already have logon access to the infrastructure where the product executes) and PR:L (a low-privileged but authenticated account is required), with AC:L and UI:N. No EPSS score is provided, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no public POC is indicated, so there is no public exploit identified at time of analysis. No SSVC decision data was supplied. The signals are internally consistent - Oracle's own description ('low privileged attacker with logon to the infrastructure') aligns with the AV:L/PR:L vector, so there is no network-vs-local conflict to resolve. Net: this is a real local privilege-escalation/takeover issue meaningful for defense-in-depth on EBS hosts, but the local-access and authentication prerequisites make mass, unauthenticated internet-wide exploitation implausible. Patch as part of the normal Oracle October 2026 CPU cycle, prioritizing internet-reachable or multi-tenant EBS infrastructure. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged account with logon access to the server infrastructure running Oracle Application Object Library (e.g. a limited application or OS-level account on an EBS host) abuses the DB Privileges component to escalate to full control of the Application Object Library. Because the CVSS vector is AV:L/AC:L/PR:L with no user interaction required, exploitation is straightforward once that foothold exists. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Local privilege escalation in Oracle E-Business Suite (Oracle Application Object Library, DB Privileges component) allows a low-privileged user who can log on to the infrastructure hosting the application to compromise the product and achieve takeover of it, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8). Affected releases are 12.2.3 through 12.2.15; the AV:L/PR:L/UI:N vector means a remote unauthenticated attacker cannot reach the flaw directly - the attacker must already hold valid low-privilege credentials plus interactive logon to the EBS host, which realistically limits exposure to insiders or intruders who have established an initial foothold. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a credible but not emergency-level patching priority.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the vendor's authoritative source for the patched Application Object Library builds covering 12.2.3 through 12.2.15; the supplied data does not enumerate a specific fixed version number, so confirm the exact patch level from the advisory before scheduling. Because exploitation is local and requires a low-privileged logon, the most effective interim controls are access-based: restrict who can obtain interactive or OS-level logon to EBS application and database hosts (removes the AV:L precondition, at the cost of tighter operational flexibility for administrators), enforce least privilege and periodic review of database accounts and AOL privilege grants so no user holds rights beyond job need, and centralize monitoring/alerting on privilege changes and unusual local sessions on EBS servers so escalation attempts are detected. Where EBS infrastructure is reachable from general user networks, segment it so that only administrative jump hosts can initiate local sessions, and review any shared low-privilege accounts that would give an attacker the PR:L foothold the vector requires. Rotating credentials and removing stale accounts reduces the pool of usable low-privilege logons while the CPU is validated and deployed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Application Object Library (AOL) is the shared metadata, security and schema foundation of Oracle E-Business Suite; its DB Privileges component governs how database privileges are assigned and enforced for EBS users and application schemas. The weakness is a privilege-handling flaw that lets a low-privileged account escalate beyond its intended database rights once it has local access to the EBS infrastructure, ultimately allowing takeover of the application layer. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H describes an attack launched locally (not over the network), of low complexity, requiring low privileges and no user interaction, with scope unchanged and full impact across confidentiality, integrity and availability. No CWE identifier was supplied in the source data, so the root-cause class is best characterized generically as improper privilege management/assignment within the AOL database privilege model rather than mapped to a specific CWE entry. No CPE identifiers were provided; affected coverage is defined by the vendor's version range for Application Object Library 12.2.3 to 12.2.15.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Oracle states exploitation needs local logon to the infrastructure (AV:L) with a low-privileged account (PR:L), no user interaction, yielding full takeover, hence C:H/I:H/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Object Library executes to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle E-Business Suite releases 12.2.3 through 12.2.15 contain a high-severity local privilege escalation in the Application Object Library DB Privileges component that could let an authenticated low-privilege user with host logon take control of the application. Practical exposure is narrower than a remote unauthenticated flaw because an attacker needs valid credentials and an existing foothold on the EBS infrastructure, concentrating risk among insiders or intruders already inside the environment. Leadership should prioritize access hardening and remediation planning for affected ERP instances, while noting that no public exploit identified at time of analysis reduces near-term urgency.
No vendor-released patch identified at time of analysis; restrict interactive logon to Oracle E-Business Suite hosts to named privileged accounts, enforce least privilege and remove unnecessary local accounts, require MFA and privileged access management, monitor local privilege changes and DB Privileges activity, segment EBS infrastructure from general user networks, review accounts with host logon rights, and monitor Oracle advisories for CVE-2026-101757.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB