CVE-2026-101850

Received Received - Intake

Cross-Site Scripting in Oracle E-Business Suite Installed Base

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Oracle

Description

Vulnerability in the Installed Base product of Oracle E-Business Suite (component: HTML UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Installed Base. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Installed Base, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Installed Base accessible data as well as unauthorized read access to a subset of Installed Base accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-20

Generated

2026-10-21

AI Q&A

2026-10-21

EPSS Evaluated

N/A

NVD

CVE-2026-101850

Affected Vendors & Products

Vendor	Product	Version / Range
Oracle	Corporation	Installed Base 12.2.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle E-Business Suite's Installed Base product (HTML UI component). It affects versions 12.2.3 to 12.2.15. An unauthenticated attacker can exploit it remotely via HTTP to compromise the Installed Base. Exploitation requires human interaction from someone other than the attacker.

Impact Analysis

An attacker could gain unauthorized access to modify, insert, or delete data in the Installed Base. They could also read a subset of the data. This may lead to data breaches, corruption, or loss of sensitive information. The impact could extend to other products due to scope change.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles or HIPAA's security requirements. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Apply the latest Oracle E-Business Suite patches for Installed Base component versions 12.2.3-12.2.15. Monitor Oracle's Critical Patch Updates for updates. Restrict network access to HTTP interfaces where possible.

Hi! I’m here to help you understand CVE-2026-101850. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70