Description
Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Partner Management. While the vulnerability is in Oracle Partner Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Partner Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Partner Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Partner Management. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L).
Published: 2026-10-20
Score: 8.4 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data modification and partial denial of service
Action: Apply Patch
AI Analysis

Impact

The Oracle Partner Management component of Oracle E‑Business Suite contains an authorization flaw that allows a low‑privileged attacker with network access via HTTP to create, delete, or modify critical data, gain unauthorized access to all data accessible through the application, and trigger a partial denial of service. The vulnerability is in the Internal Operations suite and can compromise confidentiality, integrity, and availability, with the potential to affect other related applications due to a scope change.

Affected Systems

The affected product is Oracle Partner Management for Oracle E‑Business Suite, specifically versions 12.2.3 through 12.2.15. These versions are widely deployed and support partner data and transaction processing, making them a high‑value target.

Risk and Exploitability

The CVSS 3.1 base score is 8.4, indicating high severity. Based on the description, the attack vector is likely network‑based over HTTP, with a high complexity requirement and a low privilege level. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. However, the scope change means that compromise of Partner Management could extend to other related applications, resulting in a significant overall risk for affected deployments.

Generated by OpenCVE AI on October 21, 2026 at 05:19 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Lookup the most recent Oracle security update for Partner Management in the official advisory and apply it promptly.
  • Restrict HTTP access to the Partner Management module to trusted internal networks or VPNs, eliminating unnecessary public exposure.
  • Implement network segmentation and firewall rules to limit inbound traffic to the application, and monitor application logs for unauthorized data modification attempts.

Generated by OpenCVE AI on October 21, 2026 at 05:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 05:45:00 +0000

Type Values Removed Values Added
Title Low-Privilege Remote Data Modification and Partial Denial of Service in Oracle Partner Management
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Partner Management. While the vulnerability is in Oracle Partner Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Partner Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Partner Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Partner Management. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L).
First Time appeared Oracle
Oracle partner Management
CPEs cpe:2.3:a:oracle:partner_management:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle partner Management
References
Metrics cvssV3_1

{'score': 8.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L'}

Subscriptions

Oracle Partner Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T03:55:38.008Z

Reserved: 2026-09-28T15:40:09.497Z

Link: CVE-2026-101648

cve-icon Vulnrichment

Updated: 2026-10-21T16:22:15.381Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:18:19.140

Modified: 2026-11-05T13:24:51.790

Link: CVE-2026-101648

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T23:00:14Z

Weaknesses