Description
Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Engineering. Successful attacks of this vulnerability can result in takeover of Oracle Engineering. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Application Takeover
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is located within Oracle Engineering’s Change Management component. A low‑privileged attacker with network access via HTTP can exploit this flaw to compromise confidentiality, integrity and availability, resulting in a full takeover of Oracle Engineering.

Affected Systems

Oracle Corporation’s Oracle Engineering product, part of Oracle E‑Business Suite, is affected in supported versions 12.2.3 through 12.2.15.

Risk and Exploitability

The CVSS v3.1 base score of 8.8 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is network‑based via HTTP, requiring only a low‑privileged account to compromise the system and take full control.

Generated by OpenCVE AI on October 21, 2026 at 03:09 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the patch or upgrade specified in the Oracle Critical Patch Update Oct 2026 Advisory referenced above
  • If a patch is not immediately available, restrict HTTP access to Oracle Engineering by firewall or VPN to limit exposure
  • Monitor logs for unusual Change Management activity and investigate potential exploitation attempts

Generated by OpenCVE AI on October 21, 2026 at 03:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 24 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 03:30:00 +0000

Type Values Removed Values Added
Title Oracle Engineering Remote Takeover via HTTP Exploit
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Engineering. Successful attacks of this vulnerability can result in takeover of Oracle Engineering. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle engineering
CPEs cpe:2.3:a:oracle:engineering:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle engineering
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Engineering
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-24T03:55:38.732Z

Reserved: 2026-09-28T15:40:09.508Z

Link: CVE-2026-101813

cve-icon Vulnrichment

Updated: 2026-10-22T15:12:41.992Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:37.230

Modified: 2026-10-24T04:18:15.690

Link: CVE-2026-101813

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T21:30:14Z

Weaknesses