Description
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Oracle | Oracle Application Object Library | 12.2.3 – ≤ 12.2.15 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 5 repositories
-
Sable-Research/CVE-2026-101767-research ★ 2 · Oct 28, 2026
Research notes on CVE-2026-101767 — unauthenticated vulnerability in Oracle Application Object Library (E-Business Suite)
-
seck19/CVE-2026-101767-POC ★ 1 · Oct 26, 2026
CVE-2026-101767-POC
-
aduli198/CVE-2026-101767 ★ 0 · Oct 31, 2026
Unauthenticated SQL injection (CVSS 9.8) in the Oracle EBS 12.2.312.2.15 TCF servlet
-
shivrajem/ebs-cve-2026-101767-check ★ 0 · Oct 29, 2026
Detect Oracle E-Business Suite exposure to CVE-2026-101767 (Application Object Library, CVSS 9.8): read-only DB patch check and network exposure probe
-
ashrafzaryouh/CVE-2026-101767 ★ 0 · Oct 26, 2026
CVE-2026-101767
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- NCSC-2026-0442 Kwetsbaarheden verholpen in Oracle E-Business Suite NCSC-NL (Netherlands) · Oct 21, 2026
- WID-SEC-2026-4088 Oracle E-Business Suite: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 20, 2026
References
- Oracle Advisory vendor-advisory