Oracle E-Business Suite CVE-2026-101767

No special conditions - remote unauthenticated HTTP exploitation against supported, default-reachable deployments of Oracle Application Object Library within Oracle E-Business Suite 12.2.3 through 12.2.15, per CVSS AV:N/AC:L/PR:N/UI:N and the description's 'easily exploitable...unauthenticated attacker with network access via HTTP.' The primary limiting factor is reachability of the EBS web tier: environments that restrict the EBS HTTP interface to trusted internal networks or behind a VPN/WAF materially reduce exposure, and versions outside the 12.2.3-12.2.15 range are not listed as affected. No authentication, elevated privilege, user interaction, or non-default feature enablement is required according to the vendor-supplied vector.

All CVSS signals point to maximum network-facing risk: AV:N (network/HTTP), AC:L (low complexity), PR:N (unauthenticated), UI:N (no user interaction), with full C:H/I:H/A:H impact yielding a 9.8 base score - the description explicitly states 'takeover' of the component by an unauthenticated remote attacker. This is a genuine high priority, not a high-CVSS-but-low-real-risk case: Oracle E-Business Suite is an internet- and intranet-exposed ERP platform and Oracle Application Object Library (FND) is a Core framework shared across EBS modules, so a single flaw here is broadly reachable. However, several exploitation-intelligence signals are MISSING and must be stated explicitly: no EPSS score was provided, so exploitation probability cannot be quantified; KEV status is not present (treat as not-listed → not confirmed actively exploited); no POC/exploit code reference is provided; and no SSVC decision data (exploitation/automatable/technical impact) was supplied. There is also a metadata conflict: the input Tag labels this 'Information Disclosure,' but the CVSS vector and description (I:H, A:H, 'takeover') describe full compromise, not mere disclosure - treat the tag as understating true impact and rely on the CVSS vector. Bottom line: patch-worthy critical based on vector and product exposure, but current real-world exploitation is unconfirmed from the available data.

An unauthenticated attacker reaches the Oracle E-Business Suite web tier over HTTP and sends a crafted request to an Oracle Application Object Library (FND) endpoint, exploiting the flaw without credentials or user interaction (AV:N/AC:L/PR:N/UI:N). Because the result is component takeover with full confidentiality, integrity, and availability impact, the attacker gains control over core EBS application functions and underlying data. No public exploit identified at time of analysis, so this scenario is inferred from the CVSS vector rather than demonstrated code.