Description
Vulnerability in the Strategic Network Optimization product of Oracle E-Business Suite (component: Installation of SNO). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Strategic Network Optimization. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Strategic Network Optimization. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Oracle Strategic Network Optimization contains an unauthenticated HTTP endpoint that can be abused by an attacker with network access to compromise the installation component. The vulnerability requires the attacker to persuade another user to perform an action, but once triggered it results in full takeover of the product, causing loss of confidentiality, integrity, and availability.

Affected Systems

This flaw affects Oracle E-Business Suite Strategic Network Optimization versions ranging from 12.2.3 through 12.2.15. Users of any of these releases are impacted.

Risk and Exploitability

The vulnerability is rated high with a CVSS v3.1 base score of 8.8. The EPSS score is < 1%, indicating a very low probability of exploitation, and it is not listed in CISA’s KEV catalog. The attack vector is remote over HTTP; an unauthenticated attacker can initiate the exploit, though it requires persuading another user to perform an action. Given the severity and the wide exposure to the public network, the risk is substantial.

Generated by OpenCVE AI on October 29, 2026 at 21:07 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle patch released in the October 2026 CPU for Strategic Network Optimization.
  • Disable or restrict public HTTP access to the SNO installation component, limiting it to trusted IP ranges or internal networks.
  • Enforce network segmentation or firewall rules to block unwanted traffic to the vulnerable endpoint until a patch or upgrade is applied.

Generated by OpenCVE AI on October 29, 2026 at 21:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
Title Unrestricted HTTP Access in Oracle Strategic Network Optimization Enables Remote Takeover
Weaknesses CWE-287

Thu, 29 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 03:15:00 +0000

Type Values Removed Values Added
Title Unrestricted HTTP Access in Oracle Strategic Network Optimization Enables Remote Takeover
Weaknesses CWE-287

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Strategic Network Optimization product of Oracle E-Business Suite (component: Installation of SNO). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Strategic Network Optimization. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Strategic Network Optimization. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle strategic Network Optimization
CPEs cpe:2.3:a:oracle:strategic_network_optimization:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle strategic Network Optimization
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Strategic Network Optimization
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-29T10:45:49.493Z

Reserved: 2026-09-28T15:40:09.510Z

Link: CVE-2026-101842

cve-icon Vulnrichment

Updated: 2026-10-29T10:41:13.679Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:40.177

Modified: 2026-10-29T11:17:22.410

Link: CVE-2026-101842

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T21:15:15Z

Weaknesses