Patchfirst
Patchfirst
CVE-2026-101767 Public exploit Critical · 9.8 EPSS 0.6%

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core)

Oracle Corporation · Oracle Application Object Library

Summary

The flaw lies in the Core component of Oracle Application Object Library, a product of Oracle E-Business Suite, in supported versions 12.2.3 through 12.2.15. An unauthenticated attacker with network access over HTTP can easily exploit it to take over Oracle Application Object Library, with no user interaction or prior authentication required.

Official description · NVD

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Breakdown
68.9 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15

First seen exploited 7 days after disclosure. Public exploit code (PoC-in-GitHub) appeared 6 days after disclosure.

  1. Disclosedday 0
  2. Public exploit codePoC-in-GitHub+6 days
  3. First seen exploitedVulnCheck KEV evidence+7 days

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

What security researchers reported

Not named in any threat report yet

Also mentioned in 8 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

1 link, grouped by NVD tag

Other 1

oracle.com/security-alerts/cpuoct2026.html
↑ ↓ chooseEnter openEsc close