CVE-2026-101387 in Capacity
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Capacity accessible data as well as unauthorized update, insert or delete access to some of Oracle Capacity accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Capacity. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Internal Operations component of Oracle Capacity, a module integrated into the broader Oracle E-Business Suite ecosystem. This security flaw affects specific supported releases ranging from version 12.2.3 through 12.2.15. The nature of this defect allows for exploitation by an attacker who possesses only low-level privileges and has network access to the target system via the HTTP protocol. Unlike vulnerabilities that require high-privileged accounts or complex user interaction, this flaw can be triggered remotely with minimal authentication requirements, significantly lowering the barrier to entry for malicious actors targeting enterprise resource planning environments.
From a technical perspective, the vulnerability enables unauthorized manipulation of data and service availability within the Oracle Capacity application. Successful exploitation grants an attacker the ability to read critical confidential information that should remain restricted, thereby compromising the confidentiality of sensitive business metrics and operational data. Furthermore, the flaw permits unauthorized modifications, including updates, inserts, and deletions, which undermines the integrity of the system's records. This dual impact on both confidentiality and integrity is compounded by the potential for a partial denial of service, where an attacker can disrupt normal operations, leading to availability issues that hinder business continuity.
The operational impact of this vulnerability extends beyond immediate data loss or corruption. By allowing low-privileged users to escalate their effective privileges through these actions, organizations face significant risks related to regulatory compliance and data governance. The ability to alter critical capacity planning data could lead to flawed decision-making processes within supply chain management and resource allocation strategies. Additionally, the partial denial of service capability means that even if an attacker does not exfiltrate or corrupt data, they can still inflict substantial operational disruption by rendering parts of the application inaccessible to legitimate users during peak usage periods.
In terms of industry classification standards, this vulnerability aligns with Common Weakness Enumeration categories such as CWE-269 for Improper Privilege Management and CWE-862 for Missing Authorization. The attack vector corresponds to ATT&CK techniques involving Remote Services via HTTP/S, specifically focusing on exploiting application layer vulnerabilities that do not require user interaction or high-level credentials. The CVSS 3.1 base score of 7.6 reflects the severity associated with network-accessible exploitation by low-privileged users, highlighting the critical need for immediate remediation to prevent unauthorized access and system degradation.
To mitigate this risk, organizations running affected versions of Oracle E-Business Suite must apply the latest security patches provided by Oracle specifically addressing the Internal Operations component vulnerabilities in Oracle Capacity. It is imperative that administrators verify their current version against the supported range of 12.2.3 to 12.2.15 and prioritize patching efforts for these specific releases. Beyond immediate patching, implementing strict network segmentation policies can help limit HTTP access to only authorized IP ranges, reducing the attack surface available to potential adversaries. Additionally, enforcing principle of least privilege across all user accounts ensures that even if a vulnerability is exploited, the scope of damage remains contained by restricting what low-privileged users can execute within the application environment.