Description
Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle One-to-One Fulfillment accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle One-to-One Fulfillment. CVSS 3.1 Base Score 6.8 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H).
Published: 2026-10-20
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data modification and downtime
Action: Patch
AI Analysis

Impact

A low‑privileged attacker with network access via HTTP can exploit a flaw in the Documents component of Oracle One‑to‑One Fulfillment to create, delete or modify critical data, or repeatedly crash the service. The vulnerability does not expose sensitive information directly but enables significant integrity and availability damage. The CVSS 3.1 score of 6.8 reflects the potential for unauthorized changes and denial of service, though it does not grant remote code execution.

Affected Systems

The issue affects Oracle Corporation's Oracle One‑to‑One Fulfillment product, a component of Oracle E‑Business Suite. Supported affected releases include versions 12.2.3 through 12.2.15.

Risk and Exploitability

The CVSS vector indicates a network attack with high complexity and low privileges, no user interaction, and unmodified scope. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not currently widely exploited. Nevertheless, the impact on data integrity and service availability warrants proactive remediation.

Generated by OpenCVE AI on October 21, 2026 at 01:09 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle CPU Oct 2026 patch for Oracle One‑to‑One Fulfillment (upgrade to 12.2.16 or later).
  • Restrict HTTP access to the Oracle One‑to‑One Fulfillment instance to trusted hosts or VPNs to limit exposure.
  • If a patch is not yet available, disable the Documents component or enforce additional authentication controls to mitigate unauthorized access.

Generated by OpenCVE AI on October 21, 2026 at 01:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 01:30:00 +0000

Type Values Removed Values Added
Title Low‑Privilege HTTP Attack Enables Unauthorized Data Manipulation and Denial of Service in Oracle One‑to‑One Fulfillment
Weaknesses CWE-284
CWE-399

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle One-to-One Fulfillment accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle One-to-One Fulfillment. CVSS 3.1 Base Score 6.8 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H).
First Time appeared Oracle
Oracle one-to-one Fulfillment
CPEs cpe:2.3:a:oracle:one-to-one_fulfillment:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle one-to-one Fulfillment
References
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H'}

Subscriptions

Oracle One-to-one Fulfillment
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T18:16:42.324Z

Reserved: 2026-09-28T15:40:09.500Z

Link: CVE-2026-101695

cve-icon Vulnrichment

Updated: 2026-10-22T17:43:06.579Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:23.937

Modified: 2026-10-22T19:17:34.757

Link: CVE-2026-101695

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T17:30:09Z

Weaknesses