CVE-2026-101706

Awaiting Analysis Awaiting Analysis - Queue

Unauthorized Data Access in Oracle One-to-One Fulfillment

Publication date: 2026-10-20

Last updated on: 2026-10-22

Assigner: Oracle

Description

Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle One-to-One Fulfillment accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-22

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-101706

EUVD

EUVD-2026-106107

Affected Vendors & Products

Vendor	Product	Version / Range
Oracle Corporation	Oracle One-to-One Fulfillment	12.2.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle One-to-One Fulfillment, part of Oracle E-Business Suite. It affects versions 12.2.3 to 12.2.15. A low-privileged attacker with network access via HTTP can exploit it to gain unauthorized access to critical data or all accessible data in the Oracle One-to-One Fulfillment component.

Detection Guidance

This vulnerability is specific to Oracle One-to-One Fulfillment within Oracle E-Business Suite. Detection requires checking for vulnerable versions (12.2.3-12.2.15) and verifying if HTTP network access is enabled for low-privileged users. No specific commands are provided in the context.

Impact Analysis

If you use Oracle E-Business Suite with the affected versions, an attacker could steal sensitive data or gain full access to Oracle One-to-One Fulfillment data. This could lead to data breaches, financial loss, or reputational damage depending on the data exposed.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Non-compliance may result in legal penalties, fines, or mandatory breach notifications.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) for Oracle E-Business Suite to address the vulnerability in the One-to-One Fulfillment component. Ensure the affected versions (12.2.3-12.2.15) are updated to a patched release. Restrict network access to HTTP interfaces and enforce least privilege for user accounts.

Hi! I’m here to help you understand CVE-2026-101706. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...