Description
Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA. Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 7 High
EPSS: < 1% Very Low
KEV: No
Impact: Local Privilege Escalation leading to compromise of Oracle Applications DBA, potentially allowing full control over data and services
Action: Patch Immediately
AI Analysis

Impact

The vulnerability permits a low‑privileged user who can log on to the infrastructure hosting Oracle Applications DBA to compromise the DBA component. Once compromised, the attacker can obtain full control over confidential, integrity, and availability aspects of the DBA, effectively taking over the application. The CVSS 3.1 score of 7.0 reflects the significant impact on all three security principles.

Affected Systems

Oracle Corporation’s Applications DBA product in Oracle E‑Business Suite, versions 12.2.3 through 12.2.15, remains affected. These versions run the AD Utilities component, so any environment deploying these releases is at risk.

Risk and Exploitability

The exploitation requires local access and low privilege, indicating the attack vector is local. The vulnerability’s CVSS score of 7.0 ranks it as high severity, but the EPSS score is low, at < 1%, indicating a low probability of exploitation, and it is not listed in the CISA KEV catalog. Nevertheless, the direct takeover potential warrants prompt remediation.

Generated by OpenCVE AI on October 22, 2026 at 11:53 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle E‑Business Suite patch that removes the vulnerability in Applications DBA
  • Restrict local accounts on the infrastructure to the minimum privileges necessary for system operation
  • Monitor authentication and DBA activity logs for signs of unauthorized usage or privilege escalation

Generated by OpenCVE AI on October 22, 2026 at 11:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Title Low-Privilege Local Exploitation of Oracle Applications DBA Leading to Full Compromise

Thu, 22 Oct 2026 10:15:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation Allowing Compromise of Oracle Applications DBA
Weaknesses CWE-269

Thu, 22 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Wed, 21 Oct 2026 01:45:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation Allowing Compromise of Oracle Applications DBA
Weaknesses CWE-269

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA. Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle applications Dba
CPEs cpe:2.3:a:oracle:applications_dba:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle applications Dba
References
Metrics cvssV3_1

{'score': 7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Applications Dba
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-21T21:06:27.411Z

Reserved: 2026-09-28T15:40:09.499Z

Link: CVE-2026-101681

cve-icon Vulnrichment

Updated: 2026-10-21T19:07:04.499Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:22.583

Modified: 2026-10-21T21:17:35.973

Link: CVE-2026-101681

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T23:00:14Z

Weaknesses