CVE-2026-101812: Oracle E-Business Suite Auth Bypass Flaw

CVE-2026-101812 Overview

CVE-2026-101812 affects the Oracle Complex Maintenance, Repair and Overhaul (CMRO) product within Oracle E-Business Suite. The flaw resides in the List of Values (LOV) component and impacts supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit this issue, though successful exploitation requires overcoming high attack complexity. The vulnerability maps to CWE-284: Improper Access Control and can result in unauthorized read, create, modify, or delete access to all CMRO-accessible data.

Critical Impact

Successful exploitation grants attackers full read and write access to data accessible through Oracle Complex Maintenance, Repair and Overhaul, compromising both confidentiality and integrity of maintenance records.

Affected Products

• Oracle E-Business Suite — Complex Maintenance, Repair and Overhaul 12.2.3
• Oracle E-Business Suite — Complex Maintenance, Repair and Overhaul versions 12.2.4 through 12.2.14
• Oracle E-Business Suite — Complex Maintenance, Repair and Overhaul 12.2.15

Discovery Timeline

• 2026-10-20 - CVE CVE-2026-101812 published to NVD as part of the Oracle Security Alert - October 2026
• 2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-101812

Vulnerability Analysis

The vulnerability resides in the LOV (List of Values) component of Oracle Complex Maintenance, Repair and Overhaul. LOV components in Oracle E-Business Suite provide searchable pick-list widgets backed by server-side queries against application data. Improper access control [CWE-284] in this component allows an authenticated attacker to interact with LOV-backed data and operations outside the privilege boundary intended for their role.

The issue impacts both confidentiality and integrity. Attackers can enumerate restricted records exposed through the LOV and perform unauthorized create, modify, or delete operations on CMRO data. Availability is not impacted. Exploitation requires a valid low-privileged account and additional conditions outside the attacker's control, which raises the complexity of a reliable attack.

Oracle addressed the issue in the October 2026 Critical Patch Update. Operators of Oracle E-Business Suite 12.2 should treat all CMRO deployments across 12.2.3 through 12.2.15 as affected until the quarterly patch is applied.

Root Cause

The root cause is improper access control within the LOV component. Server-side authorization checks on LOV queries and the actions that follow do not fully constrain what a low-privileged user can read or modify, allowing data access beyond the user's assigned role.

Attack Vector

The attack vector is network-based over HTTP against the Oracle E-Business Suite web tier. The attacker must authenticate with a low-privileged account that has access to the CMRO module. Oracle has not published exploitation details, and no public proof-of-concept is referenced in the advisory. Refer to the Oracle Security Alert - October 2026 for the authoritative advisory.

Detection Methods for CVE-2026-101812

Indicators of Compromise

• Unexpected create, update, or delete entries in CMRO audit tables originating from low-privileged user accounts.
• Anomalous volumes of LOV query requests from a single session against CMRO endpoints in Oracle E-Business Suite access logs.
• Access to CMRO records by user accounts outside the responsibilities normally assigned to those roles.

Detection Strategies

• Enable Oracle E-Business Suite Sign-On Audit and Page Access Tracking to record user navigation into CMRO LOV pages.
• Correlate HTTP access logs on the Oracle E-Business Suite web tier for repeated requests to LOV servlet endpoints paired with POST operations modifying CMRO objects.
• Review FND_LOGINS, FND_UNSUCCESSFUL_LOGINS, and application audit trails for low-privileged accounts performing actions on sensitive CMRO data.

Monitoring Recommendations

• Baseline normal CMRO usage per responsibility and alert on deviations in LOV query frequency or record modification counts.
• Forward Oracle E-Business Suite application and database audit logs to a centralized analytics platform for cross-session correlation.
• Monitor for new or recently modified responsibilities granting unexpected CMRO access following the October 2026 CPU disclosure window.

How to Mitigate CVE-2026-101812

Immediate Actions Required

• Apply the Oracle October 2026 Critical Patch Update for Oracle E-Business Suite as the authoritative fix.
• Inventory all Oracle E-Business Suite 12.2 environments and identify any deployment with the CMRO module enabled.
• Audit low-privileged accounts that hold any CMRO-related responsibility and remove unused assignments.

Patch Information

Oracle released the fix as part of the October 2026 Critical Patch Update. Patching details, prerequisite rollups, and version matrices are published in the Oracle Security Alert - October 2026. Customers must be on a supported Oracle E-Business Suite 12.2 code line to receive the fix.

Workarounds

• Restrict network reachability of the Oracle E-Business Suite web tier to trusted internal networks and VPN users while patching is scheduled.
• Temporarily remove CMRO responsibilities from accounts that do not require active access to the module.
• Enable enhanced auditing on CMRO tables to improve forensic visibility until the patch is deployed.

# Example: enable Oracle E-Business Suite Sign-On Audit at FORM level
# Set the profile option FND: Sign-On Audit Level = FORM
# Then review captured activity for the CMRO responsibility:
SELECT user_name, responsibility_name, form_name, start_time, end_time
  FROM apps.fnd_logins l
  JOIN apps.fnd_login_resp_forms r ON l.login_id = r.login_id
 WHERE responsibility_name LIKE '%Complex Maintenance%'
   AND start_time > SYSDATE - 7
 ORDER BY start_time DESC;