Description
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Flexfields). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A flaw in the Flexfields component of Oracle Application Object Library can be triggered by a low‑privileged attacker who can reach the application over HTTP. Based on the description, it is inferred that this vulnerability can be categorized as improper access control (CWE-284) and improper authorization (CWE-285). Successful exploitation allows the attacker to take full control of the vulnerable library, resulting in complete loss of confidentiality, integrity, and availability for the affected system.

Affected Systems

Oracle Application Object Library, part of Oracle E‑Business Suite, is affected for all releases from 12.2.3 through 12.2.15. The vulnerability applies to the Flexfields subsystem and does not affect other components of the suite.

Risk and Exploitability

The vulnerability carries a CVSS v3.1 base score of 7.5 with an attack vector of network, high complexity, and low privilege requirements. No EPSS score is currently published, and the issue is not listed in the CISA KEV catalog. The limited access requirements and HTTP exposure make this a realistic attack scenario for attackers with moderate networking skill.

Generated by OpenCVE AI on October 21, 2026 at 06:07 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle CPU Oct 2026 patch for the affected Application Object Library versions.
  • Restrict HTTP access to the Application Object Library to trusted internal IP addresses or enforce VPN‑only traffic.
  • If the Flexfields feature is not required, disable it or apply validate‑and‑sanitize rules to reduce the attack surface.

Generated by OpenCVE AI on October 21, 2026 at 06:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Nov 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 06:30:00 +0000

Type Values Removed Values Added
Title Low‑Privilege Network Attack Compromise Oracle Application Object Library via Flexfields Vulnerability
Weaknesses CWE-284
CWE-285

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Flexfields). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle application Object Library
CPEs cpe:2.3:a:oracle:application_object_library:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle application Object Library
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Application Object Library
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-11-05T18:08:25.886Z

Reserved: 2026-09-28T15:40:09.491Z

Link: CVE-2026-101552

cve-icon Vulnrichment

Updated: 2026-11-05T18:07:50.684Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:04.793

Modified: 2026-11-05T19:17:05.090

Link: CVE-2026-101552

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T16:30:08Z

Weaknesses