CVE-2026-101697

Awaiting Analysis Awaiting Analysis - Queue

Cross-Site Scripting in Oracle One-to-One Fulfillment

Publication date: 2026-10-20

Last updated on: 2026-10-22

Assigner: Oracle

Description

Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Admin Console UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle One-to-One Fulfillment, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle One-to-One Fulfillment accessible data as well as unauthorized read access to a subset of Oracle One-to-One Fulfillment accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-22

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-101697

EUVD

EUVD-2026-106099

Affected Vendors & Products

Vendor	Product	Version / Range
Oracle Corporation	Oracle One-to-One Fulfillment	12.2.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle One-to-One Fulfillment within Oracle E-Business Suite. It allows an unauthenticated attacker to remotely access the Admin Console UI via HTTP. The attack requires human interaction from a victim and can lead to unauthorized data access or modifications.

Detection Guidance

This vulnerability involves Oracle One-to-One Fulfillment in Oracle E-Business Suite. Detection requires checking for unauthorized access or modifications to the Admin Console UI component. Monitor HTTP traffic for unusual requests targeting Oracle One-to-One Fulfillment endpoints. Review logs for suspicious activity involving data access or changes. Ensure all Oracle E-Business Suite components are updated to the latest secure versions.

Impact Analysis

An attacker could exploit this to read or modify some data in Oracle One-to-One Fulfillment. Since the scope may expand, other products could also be affected. The impact includes unauthorized data access or changes, potentially leading to data breaches or integrity issues.

Compliance Impact

This vulnerability could lead to unauthorized data access or modifications, which may violate GDPR (data protection) or HIPAA (health data privacy) requirements. Non-compliance risks include legal penalties, fines, or reputational damage due to data breaches.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) for Oracle E-Business Suite, specifically for the Oracle One-to-One Fulfillment component. Ensure the Admin Console UI is updated to a patched version (12.2.3 or later). Restrict network access to the HTTP interface of the affected component and monitor for unauthorized data access or modifications.

Hi! I’m here to help you understand CVE-2026-101697. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...