Oracle Production Scheduling CVE-2026-101843

Exploitation requires the attacker to already possess a low-privileged authenticated logon (PR:L) to the infrastructure/host where Oracle E-Business Suite Production Scheduling (Internal Operations component) executes - this is a local-access flaw (AV:L), not remotely reachable over the network. High attack complexity (AC:H) indicates success depends on conditions outside the attacker's direct control (e.g., winning a race, specific runtime state, or non-trivial preconditions), limiting reliable repeatable exploitation. No user interaction is required (UI:N), and scope is unchanged (S:U), so impact is confined to Production Scheduling's own data and availability. Affected deployments are limited to Production Scheduling versions 12.2.3 through 12.2.15. The key limiting factors for defenders: an existing local authenticated foothold is mandatory, the module must be deployed and in use, and the high complexity substantially reduces practical exploitability.

This is a genuinely low-to-moderate priority issue despite the enterprise-grade product. The CVSS 3.1 base score is 4.5 (Medium), and the vector (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) is the dominant signal: exploitation is local only, requires high attack complexity, and demands an already-authenticated low-privileged account on the infrastructure where Production Scheduling runs. All three impacts (C/I/A) are rated Low/partial. There is no EPSS score provided, no CISA KEV listing, and no public POC - so none of the escalating-risk signals are present. No SSVC decision data was supplied. The combination of local-only access, high complexity, required authentication, and only partial impact places this well below internet-facing or wormable threats. The 'Denial Of Service' tag aligns with the A:L (partial DOS) impact but should not be read as a high-availability threat - the DOS is explicitly partial and local. Net assessment: patch during normal Oracle CPU cycles rather than emergency remediation; real-world exploitation risk is low given the attacker must already hold a local authenticated foothold and overcome high complexity.

An attacker who already holds a low-privileged local logon on the server running Oracle E-Business Suite Production Scheduling leverages a flaw in the Internal Operations component to read a subset of Production Scheduling data and perform limited unauthorized updates, inserts, or deletes, and can partially disrupt the service. Because the CVSS vector is AV:L/AC:H, the attack is local-only and difficult to execute reliably, requiring specific conditions to be met. No public exploit code has been identified at time of analysis.