{"id":"CVE-2026-101542","published":"2026-10-20T22:18:03.727","lastModified":"2026-10-21T14:29:49.513","description":"Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  Successful attacks of this vulnerability can result in takeover of Oracle Capacity. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A low-privileged attacker with network access via HTTP can exploit a vulnerability in Oracle Capacity (part of Oracle E-Business Suite) to fully compromise the application, leading to complete loss of confidentiality, integrity, and availability.","exploitability":"Easily exploitable by a low-privileged attacker with network access via HTTP; no user interaction required.","blast_radius":"Successful exploitation results in full system takeover of Oracle Capacity, enabling data exfiltration, unauthorized modification, and service disruption.","remediation":"Upgrade to Oracle E-Business Suite 12.2.16 or later, as versions 12.2.3–12.2.15 are affected.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["web","oracle-ebs","privilege-escalation","takeover"],"model":"garnet-coder","analyzedAt":"2026-10-26T09:04:55.535Z"}}