CVE-2026-101566

Received Received - Intake

Privilege Escalation in Oracle Application Object Library

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Oracle

Description

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Object Library executes to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-20

Generated

2026-10-21

AI Q&A

2026-10-21

EPSS Evaluated

N/A

NVD

CVE-2026-101566

Affected Vendors & Products

Vendor	Product	Version / Range
Oracle	Corporation	Oracle Application Object Library 12.2.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Application Object Library, part of Oracle E-Business Suite. It allows a low-privileged attacker with local access to take over the library by exploiting improper database privileges. The attack requires only logon access to the system where the library runs.

Impact Analysis

If exploited, this vulnerability could let an attacker gain full control over Oracle Application Object Library. This could lead to unauthorized data access, modification, or deletion, disrupting business operations and compromising sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR (data protection) and HIPAA (health data privacy). Organizations using affected Oracle E-Business Suite versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) for Oracle E-Business Suite to address the vulnerability in the Oracle Application Object Library component. Ensure proper access controls are enforced to limit low-privileged user access to the infrastructure where Oracle Application Object Library executes.

Hi! I’m here to help you understand CVE-2026-101566. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70