CVE-2026-101767 is a critical (CVSS 9.8) flaw in the Core component of Oracle Application Object Library, part of Oracle E-Business Suite. An unauthenticated attacker who can reach the product over HTTP can exploit it to take over the component.
What Is It
The vulnerability is in the Core component of Oracle Application Object Library, a product within Oracle E-Business Suite. According to Oracle's description in the NVD record, it is "easily exploitable." An attacker needs no authentication, only network access over HTTP, to compromise the affected product. A successful attack can result in takeover of Oracle Application Object Library.
Oracle ([email protected]) assigned a CVSS 3.1 base score of 9.8 (CRITICAL) with this vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality / Integrity / Availability: High / High / High
Why It Matters
This vector is about as bad as it gets. The flaw can be reached over the network, is simple to exploit, needs no credentials and needs no user interaction. Successful exploitation has high impact on confidentiality, integrity and availability. Oracle E-Business Suite deployments that can be reached over HTTP should be treated as high-priority exposure.
The record does not currently show active exploitation. No CISA Known Exploited Vulnerabilities (KEV) entry was supplied for this CVE, so KEV has not confirmed in-the-wild exploitation at this time. The NVD record is in "Received" status, published 2026-10-20, so more analysis and enrichment may follow.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle Application Object Library (Oracle E-Business Suite)
- Component: Core
- Affected supported versions: 12.2.3 through 12.2.15
The NVD record does not yet list any affected CPEs.
Patch Status
The NVD record references Oracle's October 2026 Critical Patch Update security alert. The supplied data does not include a CISA KEV entry, so there is no KEV required action or due date for this CVE. Organizations running Oracle E-Business Suite 12.2.3–12.2.15 should:
- review the October 2026 Critical Patch Update advisory for remediation guidance for Oracle Application Object Library
- prioritize systems whose HTTP interfaces can be reached from untrusted networks