Description
Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Engineering. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Engineering accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Confidentiality: Unauthorized Read Access
Action: Patch
AI Analysis

Impact

This vulnerability exists in the Change Management component of Oracle Engineering within Oracle E‑Business Suite. An unauthenticated attacker who can reach the system over HTTP can circumvent normal access controls and view a subset of data that is normally protected. The vulnerability is rated CVSS 3.1 Base Score 5.3, indicating medium severity with a confidentiality impact.

Affected Systems

Affected are Oracle Engineering product versions 12.2.3 through 12.2.15, as documented in Oracle’s CPU Oct 2026 advisory.

Risk and Exploitability

The attack vector is network‑based over HTTP, requiring no prior authentication or privileges. Exploitation is considered easily exploitable because it only needs crafted HTTP requests. With no current EPSS data and absence from the CISA KEV catalog, the likelihood of widespread exploitation is not confirmed, but the medium CVSS score and potential confidentiality compromise warrant prompt action.

Generated by OpenCVE AI on October 21, 2026 at 02:07 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the patch or update that fixes the vulnerability, as released in Oracle’s CPU Oct 2026 advisory.
  • Restrict inbound HTTP traffic to the Oracle Engineering service using firewall rules or VPN access to limit exposure to trusted hosts.
  • Force authentication or enable stricter access controls for the Change Management functionality to prevent unauthenticated data access.

Generated by OpenCVE AI on October 21, 2026 at 02:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Read Access via HTTP to Oracle Engineering Change Management
Weaknesses CWE-200
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Engineering. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Engineering accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle engineering
CPEs cpe:2.3:a:oracle:engineering:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle engineering
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Engineering
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T15:14:45.069Z

Reserved: 2026-09-28T15:40:09.508Z

Link: CVE-2026-101814

cve-icon Vulnrichment

Updated: 2026-10-22T15:10:48.545Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:37.357

Modified: 2026-10-22T16:17:18.830

Link: CVE-2026-101814

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T19:30:07Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control