Oracle E-Business Suite CVE-2026-101824

Attacker must hold a low-privileged but authenticated account (PR:L) on Oracle E-Business Suite's Document Management and Collaboration module, reachable over HTTP (AV:N), running an affected release in the 12.2.3-12.2.15 range. Exploitation is NOT fully self-contained: it requires human interaction from a different user (UI:R) - a victim (typically a higher-privileged user) must open or view the attacker-supplied attachment/content, consistent with a stored/second-order injection in the Attachments component. The principal limiting factors are therefore the need for valid low-level credentials and the dependency on victim interaction; the key risk amplifier is the scope change (S:C), which lets a successful attack reach critical data in additional products beyond the vulnerable component.

This is a genuine high-priority issue for Oracle E-Business Suite (EBS) operators, though not a drop-everything emergency absent exploitation evidence. The CVSS 3.1 score of 8.7 is driven by network vector (AV:N), low attack complexity (AC:L), only low privileges required (PR:L), and critically a scope change (S:C) with High confidentiality and integrity impact - the Oracle text states attacks 'may significantly impact additional products,' meaning a compromise of the Attachments component can pivot beyond Document Management and Collaboration. The single mitigating metric is UI:R (requires human interaction from a person other than the attacker), which combined with the Attachments vector strongly implies a stored/second-order injection (e.g., stored XSS or malicious attachment content) where a low-privileged user plants content and a higher-privileged victim triggers it. No EPSS probability, no CISA KEV listing, and no public POC were supplied in the input, so there is no evidence of active exploitation or published exploit code - exploitation status is therefore 'no public exploit identified at time of analysis.' A notable caveat: EBS is a historically heavily targeted enterprise platform and the scope-change rating means real-world blast radius could exceed the nominal component, so the absence of EPSS/KEV data should be read as 'unmeasured,' not 'low risk.' Patch via Oracle's October 2026 Critical Patch Update is the decisive control.

A low-privileged but authenticated EBS user uploads or submits a crafted attachment/content into the Document Management and Collaboration module; when a higher-privileged user (e.g., an administrator or reviewer) opens or views that attachment through the web interface, the malicious payload executes in the victim's authenticated context. Because the vulnerability carries a scope change, the resulting access can extend to critical data in additional products reachable from that session. No public exploit code was identified in the provided data, so this scenario is inferred from the CVSS vector (AV:N/PR:L/UI:R/S:C) rather than a known weaponized exploit.