Description
Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Quality. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Quality accessible data as well as unauthorized access to critical data or complete access to all Oracle Quality accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-10-20
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Data Integrity & Confidentiality Compromise
Action: Immediate Patch
AI Analysis

Impact

Oracle Quality's Internal Operations component contains a vulnerability that allows a low‑privileged attacker with network access to send crafted HTTP requests, resulting in unauthorized creation, deletion, or modification of critical data. The impact is a breach of confidentiality and integrity, exposing all data accessible through Oracle Quality but not affecting availability.

Affected Systems

Oracle Corporation's Oracle Quality product within Oracle E‑Business Suite, specifically the Internal Operations component, is affected across version range 12.2.3 through 12.2.15.

Risk and Exploitability

The CVSS v3.1 base score of 8.1 indicates high severity with significant confidentiality and integrity impact. The attack vector is network‑based via HTTP, with low access complexity and low privilege required, making exploitation relatively easy for an attacker who can reach the relevant endpoints. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. Given the ease of exploitation and high impact, this should be regarded as a critical threat.

Generated by OpenCVE AI on October 21, 2026 at 03:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle CPU Oct 2026 security patch for Oracle Quality.
  • Restrict external HTTP access to Oracle Quality to trusted IP ranges or a VPN tunnel only.
  • Review and tighten user privileges so that only authorized roles can perform data modifications in Oracle Quality.

Generated by OpenCVE AI on October 21, 2026 at 03:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 03:45:00 +0000

Type Values Removed Values Added
Title Remote Data Manipulation via Oracle Quality HTTP Endpoint
Weaknesses CWE-269
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Quality. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Quality accessible data as well as unauthorized access to critical data or complete access to all Oracle Quality accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle quality
CPEs cpe:2.3:a:oracle:quality:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle quality
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Quality
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-29T10:45:49.909Z

Reserved: 2026-09-28T15:40:09.509Z

Link: CVE-2026-101831

cve-icon Vulnrichment

Updated: 2026-10-29T10:41:20.903Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:39.173

Modified: 2026-10-29T11:17:21.973

Link: CVE-2026-101831

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T20:15:05Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-284

    Improper Access Control