Description
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Object Library executes to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 7.8 High
EPSS: n/a
KEV: No
Impact: Privilege Escalation / System Compromise
Action: Assess Impact
AI Analysis

Impact

The vulnerability resides in the DB Privileges component of Oracle Application Object Library in Oracle E‑Business Suite. An attacker with low privileged local access can exploit this flaw to compromise the Application Object Library, potentially violating confidentiality, integrity, and availability. The flaw is reflected by a CVSS 3.1 base score of 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected Systems

Oracle Application Object Library in Oracle E‑Business Suite, versions 12.2.3 through 12.2.15, are affected. The product is provided by Oracle Corporation.

Risk and Exploitability

The vulnerability has a high severity with a CVSS base score of 7.8. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. According to the description, the vulnerability is easily exploitable by an attacker with low privileged local access, who can log onto the infrastructure and manipulate the DB Privileges component to pursue higher control, potentially resulting in a full takeover of the Application Object Library.

Generated by OpenCVE AI on October 21, 2026 at 05:02 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check for official fixes in Oracle's security advisories
  • Apply database least‑privilege principles to restrict low privileged accounts
  • Conduct a security audit of database roles and privileges to ensure they match the principle of least privilege

Generated by OpenCVE AI on October 21, 2026 at 05:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 05:30:00 +0000

Type Values Removed Values Added
Title Privilege Escalation in Oracle Application Object Library (DB Privileges)
Weaknesses CWE-269

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Object Library executes to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle application Object Library
CPEs cpe:2.3:a:oracle:application_object_library:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle application Object Library
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Application Object Library
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:21:35.439Z

Reserved: 2026-09-28T15:40:09.492Z

Link: CVE-2026-101566

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:18:08.467

Modified: 2026-10-20T22:18:08.467

Link: CVE-2026-101566

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T05:15:07Z

Weaknesses
  • CWE-269

    Improper Privilege Management