Description
Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Partner Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Partner Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Partner Management. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).
Published: 2026-10-20
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data modification and availability disruption
Action: Immediate patch
AI Analysis

Impact

The vulnerability resides in the Internal Operations component of Oracle Partner Management. An attacker with low privileges who can reach the system over HTTPS can exploit it to create, delete, or modify critical data. The flaw also permits a partial denial of service, impacting the availability of Partner Management. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, indicating high integrity impact and moderate availability impact.

Affected Systems

Oracle Corporation’s Oracle Partner Management product, part of Oracle E‑Business Suite. Affected versions are 12.2.3 through 12.2.15. Administrators should verify which sub‑version they are running and plan to update accordingly.

Risk and Exploitability

The CVSS base score of 7.1 places this vulnerability in the high severity range. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog, but the low attack complexity and low privilege requirement make it feasibly exploitable over a network. The most likely attack vector is HTTPS traffic to the internal operations endpoint, which an attacker can abuse to perform unauthorized data manipulation or induce a partial denial of service.

Generated by OpenCVE AI on October 21, 2026 at 04:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Deploy the latest Oracle Partner Management security patch or upgrade to a version newer than 12.2.15.
  • Limit HTTPS access to the Partner Management interface to trusted internal networks or IP ranges.
  • Review and tighten access controls for low‑privileged user accounts to restrict creation, deletion, or modification of critical data.

Generated by OpenCVE AI on October 21, 2026 at 04:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 04:45:00 +0000

Type Values Removed Values Added
Title Authentication Bypass via HTTPS in Oracle Partner Management
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Partner Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Partner Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Partner Management. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).
First Time appeared Oracle
Oracle partner Management
CPEs cpe:2.3:a:oracle:partner_management:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle partner Management
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L'}

Subscriptions

Oracle Partner Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-21T18:33:34.743Z

Reserved: 2026-09-28T15:40:09.497Z

Link: CVE-2026-101649

cve-icon Vulnrichment

Updated: 2026-10-21T18:19:52.644Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:18:19.263

Modified: 2026-11-05T13:24:45.530

Link: CVE-2026-101649

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T17:00:09Z

Weaknesses