Description
Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: Role Summary). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Common Applications. While the vulnerability is in Oracle Common Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Common Applications accessible data as well as unauthorized access to critical data or complete access to all Oracle Common Applications accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N).
Published: 2026-10-20
Score: 7.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data modification and full data access
Action: Apply patch
AI Analysis

Impact

The vulnerability resides in the Role Summary component of Oracle Common Applications and allows a high‑privileged attacker with network access over HTTP to create, modify, delete, or obtain complete access to all accessible data. As a result, confidential and integral business data can be altered or compromised in a manner that bypasses normal authorization controls.

Affected Systems

Oracle Common Applications of Oracle E‑Business Suite, versions 12.2.3 through 12.2.15. The attack, while focused on this component, can affect other related products due to a scope change.

Risk and Exploitability

The CVSS 3.1 base score of 7.7 reflects high severity with Network access, Hard attack complexity, High privileges required, and a change in scope. EPSS data is not available and the vulnerability is not yet in the CISA KEV catalog, yet the combination of a high CVSS, network‑exposed entry point, and broad impact indicates a meaningful threat with potential for widespread data compromise.

Generated by OpenCVE AI on October 21, 2026 at 01:03 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the vendor‑issued patch for the Role Summary component in Oracle Common Applications for affected versions.
  • Configure firewall or network segmentation to limit HTTP exposure to Oracle Common Applications to trusted IP addresses only.
  • Review and tighten role‑based access controls, ensuring that only necessary privileges are granted for users interacting with the Role Summary functionality.
  • Monitor database and application logs for anomalous create, delete, or modify operations against Oracle Common Applications data.

Generated by OpenCVE AI on October 21, 2026 at 01:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 03 Nov 2026 06:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 01:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Access and Data Modification via Role Summary in Oracle Common Applications
Weaknesses CWE-284
CWE-305

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: Role Summary). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Common Applications. While the vulnerability is in Oracle Common Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Common Applications accessible data as well as unauthorized access to critical data or complete access to all Oracle Common Applications accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N).
First Time appeared Oracle
Oracle common Applications
CPEs cpe:2.3:a:oracle:common_applications:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle common Applications
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N'}

Subscriptions

Oracle Common Applications
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-11-03T04:56:01.641Z

Reserved: 2026-09-28T15:40:09.501Z

Link: CVE-2026-101705

cve-icon Vulnrichment

Updated: 2026-10-22T15:11:49.517Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:24.953

Modified: 2026-11-03T05:18:27.550

Link: CVE-2026-101705

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T17:30:09Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-305

    Authentication Bypass by Primary Weakness