CVE-2026-101814 in Engineering
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Engineering. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Engineering accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Change Management component of Oracle Engineering, a critical module in the Oracle E-Business Suite ecosystem designed to manage engineering change orders and related workflows. This security flaw affects supported software versions ranging from 12.2.3 through 12.2.15. The core issue stems from an insufficient access control mechanism that fails to properly verify user privileges before processing requests directed at specific application endpoints. Consequently, the system does not adequately distinguish between authenticated administrative users and unauthenticated external actors when handling data retrieval operations within this module.
From a technical perspective, the flaw allows for unauthorized read access to sensitive information without requiring any form of authentication or user interaction. An attacker with network connectivity to the affected Oracle E-Business Suite instance can exploit this weakness by sending specially crafted HTTP requests directly to vulnerable endpoints associated with the Change Management functionality. Because no valid session token or credentials are required, the attack vector is straightforward and highly accessible. The vulnerability aligns closely with CWE-284, which describes Improper Access Control, specifically highlighting scenarios where access control decisions are not enforced before granting access to resources. Furthermore, this behavior maps directly to MITRE ATT&CK technique T1078, Valid Accounts, although in this specific case the attacker operates without any account at all due to the authentication bypass nature of the flaw.
The operational impact of this vulnerability is primarily centered on data confidentiality rather than integrity or availability. Successful exploitation enables an unauthenticated actor to retrieve a subset of Oracle Engineering accessible data that should be restricted to authorized personnel only. While the CVSS 3.1 base score of 5.3 indicates a medium severity level, driven by low attack complexity and no user interaction requirements, the actual risk depends heavily on the sensitivity of the exposed data. In engineering contexts, this could potentially include proprietary design specifications, bill-of-materials details, or intellectual property related to product development. Such information leakage can lead to competitive disadvantage, regulatory non-compliance if sensitive personal data is involved, and erosion of stakeholder trust in the organization's security posture.
To mitigate this risk, organizations running affected versions must apply the latest available security patches provided by Oracle for their specific E-Business Suite release stream. Immediate remediation involves upgrading or patching to a version that includes fixes for this Change Management access control issue. In addition to applying vendor-supplied updates, it is advisable to implement network-level controls such as web application firewalls configured with rulesets capable of detecting and blocking anomalous HTTP requests targeting known vulnerable endpoints. Restricting direct internet-facing access to the Oracle E-Business Suite environment by placing it behind a secure perimeter or using reverse proxies with strict authentication requirements can also reduce the attack surface. Regular security audits and penetration testing focused on unauthenticated endpoint exposure should be conducted to ensure that similar misconfigurations do not exist elsewhere in the application suite.