Bills of Material CVE-2026-101823

Requires a valid low-privileged account on the target Oracle E-Business Suite instance (PR:L) with network HTTP access to the Bills of Material product's Internal Operations component; no user interaction is needed. Exploitation is explicitly rated difficult (AC:H), meaning success depends on conditions outside the attacker's direct control - likely specific application state, timing, or configuration - which materially limits reliable or large-scale exploitation. Affected scope is limited to supported EBS versions 12.2.3 through 12.2.15; the authentication requirement and high complexity are the primary limiting factors defenders can rely on.

Oracle's CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5) describes a network-reachable but hard-to-exploit flaw requiring an authenticated low-privileged account, yielding full confidentiality, integrity and availability loss ('takeover'). The AC:H and PR:L metrics are the key risk-reducers: an attacker needs valid credentials to the EBS instance AND must overcome conditions outside their control, which argues against trivial mass exploitation. No EPSS score, CISA KEV listing, or POC was provided in the input, so there is no evidence of active exploitation or available exploit code - this is a high-CVSS issue whose real-world urgency is currently driven by patch hygiene rather than confirmed in-the-wild activity. Note one metadata inconsistency: the tag labels this 'Information Disclosure,' but the vector and description indicate full system takeover (C:H/I:H/A:H), not mere disclosure - treat the impact as complete compromise, not read-only. Because EBS is internet-facing in many deployments and credentials are often broadly provisioned, the PR:L requirement is a weaker barrier than it appears in large organizations; prioritize patching via the October 2026 CPU accordingly.

An attacker who already holds a low-privileged Oracle E-Business Suite account (or phished/reused credentials) sends crafted HTTP requests to the Bills of Material Internal Operations component and, by satisfying the difficult-to-meet exploitation conditions, escalates to full control of the Bills of Material product. No public exploit code or active exploitation is identified at time of analysis, and the high attack complexity (AC:H) means exploitation is non-trivial and likely requires specific timing or state.