{"id":"CVE-2026-101767","published":"2026-10-20T22:18:32Z","modified":"2026-10-21T18:44:55Z","title":"Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core)","vendor":"Oracle Corporation","product":"Oracle Application Object Library","tier":"core","eol":null,"description":{"text":"Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","provenance":"source","from":"NVD"},"summary":{"text":"The flaw lies in the Core component of Oracle Application Object Library, a product of Oracle E-Business Suite, in supported versions 12.2.3 through 12.2.15. An unauthenticated attacker with network access over HTTP can easily exploit it to take over Oracle Application Object Library, with no user interaction or prior authentication required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T04:54:14Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00614,"percentile":0.49427,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-10-27","exploitedFirstSeen":"2026-10-27","ransomware":false,"evidence":[{"url":"https://previdian.com/CVE-2026-101767","date":"2026-10-27"},{"url":"https://x.com/DefusedCyber/status/2115099999973364147","date":"2026-10-27"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-287","name":"Improper Authentication"},{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"}],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-106168","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-106168","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":5,"skipped":0,"earliest":"2026-10-26","earliestUrl":"https://github.com/seck19/CVE-2026-101767-POC","repos":[{"name":"seck19/CVE-2026-101767-POC","url":"https://github.com/seck19/CVE-2026-101767-POC","stars":1,"created":"2026-10-26"},{"name":"0xBlackash/CVE-2026-101767","url":"https://github.com/0xBlackash/CVE-2026-101767","stars":0,"created":"2026-10-26"},{"name":"Sable-Research/CVE-2026-101767-research","url":"https://github.com/Sable-Research/CVE-2026-101767-research","stars":0,"created":"2026-10-28"},{"name":"shivrajem/ebs-cve-2026-101767-check","url":"https://github.com/shivrajem/ebs-cve-2026-101767-check","stars":0,"created":"2026-10-29"},{"name":"aduli198/CVE-2026-101767","url":"https://github.com/aduli198/CVE-2026-101767","stars":0,"created":"2026-10-31"}]},"first":{"date":"2026-10-26","source":"PoC-in-GitHub","url":"https://github.com/seck19/CVE-2026-101767-POC"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-20","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101767","provenance":"source"},{"date":"2026-10-26","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/seck19/CVE-2026-101767-POC","provenance":"source"},{"date":"2026-10-27","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://previdian.com/CVE-2026-101767","provenance":"source"}],"speed":{"daysToPublicExploit":6,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":66.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 5 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":9.89,"detail":"percentile 0.4943"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"5 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}