CVE-2026-101500

Awaiting Analysis Awaiting Analysis - Queue

Privilege Escalation in Oracle Global Lifecycle Management OPatchAuto

Publication date: 2026-10-20

Last updated on: 2026-10-23

Assigner: Oracle

Description

Vulnerability in the Oracle Global Lifecycle Management OPatchAuto product of Oracle Global Lifecycle Management (component: Database extensions). Supported versions that are affected are 12.2.0.1.16-12.2.0.1.52. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Global Lifecycle Management OPatchAuto executes to compromise Oracle Global Lifecycle Management OPatchAuto. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Global Lifecycle Management OPatchAuto. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-23

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-101500

EUVD

EUVD-2026-105915

Affected Vendors & Products

Vendor	Product	Version / Range
Oracle Corporation	Oracle Global Lifecycle Management OPatchAuto	12.2.0.1.16

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Global Lifecycle Management OPatchAuto affecting versions 12.2.0.1.16 to 12.2.0.1.52. It allows a high-privileged attacker with local access to compromise the product through human interaction. Successful exploitation can lead to full takeover of OPatchAuto.

Detection Guidance

Detection requires manual review of Oracle Global Lifecycle Management OPatchAuto logs and configurations. Check for unusual privilege escalation attempts or unauthorized modifications to the OPatchAuto infrastructure. Review user activity logs for non-admin users attempting to access privileged functions.

Impact Analysis

If you use Oracle Global Lifecycle Management OPatchAuto in your environment, an attacker with local access could gain control over it. This could allow them to manipulate database operations, access sensitive data, or disrupt services.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. Compliance may be compromised if exploited.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) or patch for Oracle Global Lifecycle Management OPatchAuto to address this vulnerability. Ensure only trusted users have logon access to systems where this component executes.

Hi! I’m here to help you understand CVE-2026-101500. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...