← Back to Vulnerability Reports CVE Intelligence

CVE-2026-101767

See advisory•CRITICAL · CVSS 9.8•No exploitation reported

What is CVE-2026-101767?

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS9.8 NVD 3.1

SeverityCRITICAL

ExploitationNo exploitation reported

EPSS1% · P49

Triage statusNo Known Exploit

ActionPatch within 48 hours

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWECWE-287

NVD published2026-10-20

NVD last modified2026-10-21

Timeline

2026-10-20Published to the U.S. National Vulnerability Database (NVD)
2026-10-21NVD record last updated
2026-10-29First covered in a defend.network daily briefing

Affected product

See advisory

Remediation Steps

Apply Oracle's critical patch released in October 2026
Prioritize systems running Oracle E-Business Suite exposed to internet or untrusted networks
Monitor access logs for exploitation attempts targeting the Oracle Application Object Library

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 4 of October 2026 (October 26 – November 1)
Volt Typhoon dismantled; PHP RCE active; Microsoft patches 1,400+ flaws (2026-10-29)

Related vulnerabilities

CVE-2026-105133 – Ahsay AhsayCBS (same weakness: CWE-287)
CVE-2026-82329 – JFrog Artifactory (same weakness: CWE-287)
CVE-2026-42018 – JFrog Artifactory (same weakness: CWE-287)
CVE-2026-65400 – Apple MacOS (same weakness: CWE-287)
CVE-2026-15981 (same weakness: CWE-287)
CVE-2026-16232 – Check Point SmartConsole (same weakness: CWE-287)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.