Description
Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Order Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Data Confidentiality Exposure
Action: Apply Patch
AI Analysis

Impact

The vulnerability resides in Oracle Order Management’s Product Diagnostic Tools component. When accessed over HTTP by an attacker who has only low‑privilege credentials, the system fails to validate the authority of that user, allowing unauthorized reading of all data that the user can reach within Oracle Order Management. The impact is a high confidentiality breach while integrity and availability remain unchanged.

Affected Systems

Oracle Order Management, versions 12.2.3 through 12.2.15, are affected. The vulnerability applies to all installations of these versions that expose the Product Diagnostic Tools interface.

Risk and Exploitability

The CVSS score of 6.5 classifies this as a Medium severity vulnerability. Because the attack vector is Network and requires only low privileges, the risk of exploitation is high in environments where the Order Management HTTP endpoint is reachable from untrusted networks. No EPSS metric is currently available, and the vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on October 21, 2026 at 02:43 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Deploy the Oracle Order Management patch that addresses CVE-2026-101857 (check the Oracle CPU on Oct‑2026 for the appropriate release).
  • Restrict HTTP access to the Order Management application by limiting connectivity to trusted IP ranges or forcing all connections through a corporate VPN.
  • Disable or restrict the Product Diagnostic Tools feature for all non‑administrator accounts to ensure that only privileged users can invoke diagnostic actions.

Generated by OpenCVE AI on October 21, 2026 at 02:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 03:00:00 +0000

Type Values Removed Values Added
Title Unrestricted Data Disclosure via HTTP in Oracle Order Management
Weaknesses CWE-200
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Order Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle order Management
CPEs cpe:2.3:a:oracle:order_management:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle order Management
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Order Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T11:59:56.939Z

Reserved: 2026-09-28T15:40:09.511Z

Link: CVE-2026-101857

cve-icon Vulnrichment

Updated: 2026-10-27T11:59:46.743Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:41.780

Modified: 2026-10-27T12:17:03.183

Link: CVE-2026-101857

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T21:45:06Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control