Oracle EBS Assets CVE-2026-101815

Exploitation requires a valid low-privileged account on the target Oracle E-Business Suite instance (CVSS PR:L) and network HTTP access to the Assets product's Internal Operations component; no user interaction is needed (UI:N) and attack complexity is low (AC:L). Only versions 12.2.3 through 12.2.15 are affected. The principal limiting factor is the authentication requirement - this is not an unauthenticated flaw, so exposure depends on how broadly low-privileged EBS accounts are provisioned and whether the application tier is reachable by the attacker; impact is confined to the Assets module (scope unchanged, S:U).

This is a genuine but moderate-priority issue rather than a drop-everything emergency. The vendor CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H, score 7.6) describes a network-reachable, low-complexity attack requiring only low privileges (PR:L) and no user interaction, with the dominant impact being High Availability (A:H) - i.e. a complete, repeatable DOS of the Assets module - plus limited confidentiality and integrity impact (C:L/I:L). No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so exploitation probability cannot be quantified from the data. There is no public exploit identified at time of analysis and no evidence of active exploitation (not in CISA KEV). The main real-world risk driver is that EBS is often internet-facing and the attacker needs only a low-privileged authenticated account (PR:L), which is common in large multi-user ERP deployments; however, that authentication requirement and the self-contained scope (S:U) meaningfully reduce the chance of mass, unauthenticated exploitation. Net: a legitimately exploitable availability threat for organizations exposing EBS, but not a high-CVSS-but-negligible-risk case - prioritize patching in the next Oracle CPU cycle rather than as a zero-day emergency.

An attacker who already holds a low-privileged EBS account (or has compromised one) sends crafted HTTP requests to the Assets module over the network, with no user interaction required. Because attack complexity is low, they can reliably trigger a hang or repeatable crash producing a complete denial of service of Assets, and can additionally perform limited unauthorized reads and writes to Assets-accessible data. No public exploit code is known at time of analysis.