CVE-2026-101855 is a vulnerability in Oracle Product Hub within Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data or potentially all data accessible by Oracle Product Hub. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with high confidentiality impact but no impact on integrity or availability. Oracle has released security patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update advisory.
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-101851 is a vulnerability in Oracle E-Business Suite's Installed Base component (Data Provider UI) affecting versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data and perform unauthorized update, insert, or delete operations on some accessible data. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity with significant confidentiality and integrity impacts. Oracle has released patches addressing this vulnerability as part of its October 2026 Critical Patch Update.
CVE-2026-101850 is a vulnerability in the Installed Base component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows an unauthenticated attacker with network access via HTTP to compromise the product, requiring user interaction from a person other than the attacker. The vulnerability can lead to unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of data. The vulnerability has a CVSS 3.1 base score of 6.1, indicating medium severity with confidentiality and integrity impacts. The vulnerability's scope extends beyond Installed Base, potentially affecting additional Oracle products. Oracle has released patches as part of their October 2026 Critical Patch Update advisory.
CVE-2026-101849 is a vulnerability in Oracle E-Business Suite's Installed Base component (Create Item Instance) affecting versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the product, requiring user interaction from another person. Exploitation can lead to unauthorized access to critical data and unauthorized modification of some data. The vulnerability has a CVSS 3.1 base score of 7.6, indicating high severity with significant confidentiality and integrity impacts. Oracle has released patches addressing this and other vulnerabilities in their October 2026 Critical Patch Update advisory.
CVE-2026-101847 is a vulnerability in Oracle Bills of Material component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to potentially take over the Oracle Bills of Material. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has released security patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update advisory.
CVE-2026-101846 is a vulnerability in Oracle Purchasing, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on accessible data. Exploitation requires human interaction from a user other than the attacker. The vulnerability has a CVSS 3.1 base score of 3.5, indicating a low severity primarily impacting data integrity.
CVE-2026-101845 is a vulnerability in Oracle Purchasing, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on some accessible data. The vulnerability is rated as low severity with a CVSS 3.1 base score of 3.1, primarily impacting data integrity. Exploitation is considered difficult due to high attack complexity. Oracle has released patches addressing this vulnerability as part of its October 2026 Critical Patch Update.
CVE-2026-101844 is a vulnerability in Oracle Concurrent Processing component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized read access to some data accessible by Oracle Concurrent Processing. The vulnerability is rated with a low severity score of 3.1 due to its limited confidentiality impact and difficult exploitation conditions.
CVE-2026-101843 is a vulnerability in Oracle E-Business Suite's Production Scheduling component affecting versions 12.2.3 through 12.2.15. It allows a low privileged attacker with logon access to the infrastructure where Production Scheduling runs to potentially compromise the component. Successful exploitation can lead to unauthorized read, update, insert, or delete access to some accessible data and may cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 4.5, indicating medium severity.
CVE-2026-101842 is a high-severity vulnerability in Oracle Corporation's Strategic Network Optimization product within the Oracle E-Business Suite. It affects versions 12.2.3 through 12.2.15. The flaw allows an unauthenticated attacker with network access via HTTP to compromise the product, requiring user interaction from a person other than the attacker. Successful exploitation can lead to full takeover of the Strategic Network Optimization component. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability.
CVE-2026-101841 is a high-severity vulnerability in the Global Order Promising component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially impacting additional Oracle products. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, as well as unauthorized access to all data accessible by Global Order Promising. The vulnerability has a CVSS 3.1 base score of 8.2, indicating high confidentiality and integrity impacts. Oracle has published a Critical Patch Update advisory addressing this and many other vulnerabilities, recommending customers apply patches promptly.
CVE-2026-101840 is a vulnerability in Oracle Contract Lifecycle Management for Public Sector, part of Oracle E-Business Suite. It affects versions 12.2.3 through 12.2.15. The flaw allows a high privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The CVSS 3.1 base score is 7.2, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has released patches as part of its October 2026 Critical Patch Update. Customers are strongly advised to apply these patches promptly to mitigate risk.
CVE-2026-101837 is a vulnerability in Oracle Shipping Execution component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to cause denial of service by hanging or crashing the service, and to gain unauthorized read and write access to some data. The vulnerability has a CVSS 3.1 base score of 7.7, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has released patches for this and many other vulnerabilities in their October 2026 Critical Patch Update.
CVE-2026-101836 is a vulnerability in Oracle E-Business Suite's iSupplier Portal (component: Internal Operations) affecting versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the portal, potentially gaining unauthorized access to critical or all accessible data. The CVSS 3.1 base score is 6.5, indicating a medium severity primarily due to confidentiality impact. Oracle has released patches addressing this vulnerability as part of their October 2026 Critical Patch Update.
CVE-2026-101835 is a vulnerability in Oracle Shipping Execution (part of Oracle E-Business Suite) affecting versions 12.2.3 through 12.2.15. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical or all accessible data within Oracle Shipping Execution. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with a significant confidentiality impact. Oracle has released security patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update advisory.
CVE-2026-101834 is a vulnerability in Oracle Shipping Execution, part of Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.15. It allows an unauthenticated attacker with network access via HTTP to potentially take over the Oracle Shipping Execution component. The vulnerability is rated high severity with a CVSS 3.1 base score of 8.1, impacting confidentiality, integrity, and availability. The vulnerability is difficult to exploit due to the required conditions. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which provides patches for affected products.
CVE-2026-101833 is a vulnerability in Oracle Shipping Execution within Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized access to critical data, unauthorized modification of some data, and partial denial of service. The vulnerability has a CVSS 3.1 base score of 7.6, indicating high severity.