Description
Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Java Server Issues). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Successful attacks of this vulnerability can result in takeover of Oracle One-to-One Fulfillment. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote system compromise
Action: Immediate Patch
AI Analysis

Impact

This vulnerability in Oracle One-to-One Fulfillment allows an attacker with low privileges and network access via HTTP to compromise the application. A successful exploitation can lead to full takeover, resulting in loss of confidentiality, integrity, and availability, as indicated by the CVSS 3.1 base score of 7.5.

Affected Systems

The affected product is Oracle One-to-One Fulfillment, part of Oracle E‑Business Suite. Supported affected versions are 12.2.3 through 12.2.15.

Risk and Exploitability

The attack vector is over the network using HTTP, requiring only lower-level privileges. While the exploit is described as difficult to execute, a successful attack would grant an attacker full control over the application. The CVSS score of 7.5 indicates high risk. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, but the potential impact warrants prompt action.

Generated by OpenCVE AI on October 21, 2026 at 01:07 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle CPU October 2026 patch for Oracle One-to-One Fulfillment referenced in the vendor advisory.
  • Limit HTTP access to the Oracle One-to-One Fulfillment instance to trusted IP ranges or a dedicated network segment.
  • Implement stricter application-level access controls and enforce the principle of least privilege for all users.
  • Monitor authentication logs and network traffic for anomalous activity that may indicate exploitation attempts.

Generated by OpenCVE AI on October 21, 2026 at 01:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 01:30:00 +0000

Type Values Removed Values Added
Title Remote Code Execution in Oracle One-to-One Fulfillment via HTTP
Weaknesses CWE-284
CWE-640

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Java Server Issues). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Successful attacks of this vulnerability can result in takeover of Oracle One-to-One Fulfillment. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle one-to-one Fulfillment
CPEs cpe:2.3:a:oracle:one-to-one_fulfillment:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle one-to-one Fulfillment
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle One-to-one Fulfillment
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T15:20:15.899Z

Reserved: 2026-09-28T15:40:09.500Z

Link: CVE-2026-101698

cve-icon Vulnrichment

Updated: 2026-10-22T15:11:40.556Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:24.280

Modified: 2026-10-22T16:17:12.307

Link: CVE-2026-101698

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T22:45:13Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-640

    Weak Password Recovery Mechanism for Forgotten Password