Oracle CLM CVE-2026-101840

Exploitation requires an authenticated session with HIGH application privileges (PR:H) on Oracle Contract Lifecycle Management for Public Sector, reached over the network via HTTP against the Award/PO component on affected E-Business Suite versions 12.2.3 through 12.2.15. There is no user-interaction requirement (UI:N) and complexity is low (AC:L), so once a privileged account is held the attack is straightforward; the limiting factor is the need for that pre-existing high-privilege access, meaning realistic risk concentrates on privileged insiders, compromised admin credentials, or deployments where the CLM application is reachable by attackers who have already escalated.

The CVSS 3.1 base score is 7.2 (High), driven by full confidentiality, integrity and availability impact (C:H/I:H/A:H) culminating in product takeover. However, the single most important mitigating signal is PR:H - exploitation requires the attacker to already hold high (administrative) privileges on the application, which sharply narrows the realistic threat to insiders or an attacker who has already achieved privileged access through a separate foothold. Network vector (AV:N) and low complexity (AC:L) make the final step trivial once that privilege is held, but it is not a standalone remote-unauthenticated breach. No EPSS score was supplied, the vulnerability is NOT in the CISA KEV catalog, and no public proof-of-concept is referenced, so there is no evidence of active exploitation or weaponization. SSVC-style read: exploitation status is 'none observed', technical impact is 'total', but the privilege prerequisite makes automatable exploitation unlikely. Net assessment: this is a legitimate high-severity patch-worthy flaw but, absent exploitation signals and given the PR:H gate, it is a scheduled-patch priority (Oracle quarterly CPU) rather than an emergency, except in environments where the CLM application is internet-exposed or where privileged-account hygiene is weak. Note a metadata conflict: the input tag labels this 'Information Disclosure', but the CVSS vector and description describe full takeover (C/I/A all High) - treat it as a takeover issue, not merely disclosure.

An attacker who already holds a high-privilege application account in Oracle Contract Lifecycle Management for Public Sector (for example a compromised administrator or a malicious privileged insider) sends crafted HTTP requests to the Award/PO component and leverages the flaw to fully compromise the application. No public exploit code is known, and because the CVSS vector requires PR:H the attack is not viable for an unauthenticated outsider without first obtaining privileged credentials.