CVE-2026-101640 Oracle Marketing - Broken Authentication

Oracle Marketing in Oracle E-Business Suite 12.2.3-12.2.15 contains an unauthorized access vulnerability caused by insufficient authentication in the Audience component, letting unauthenticated attackers with network access via HTTP access and modify critical data.

CVSS base score 8.2 /10
High
CISA KEV
Not listed
Public exploit
None known
Authentication
Not required
View the NVD record ↗

Details

Type
Broken Authentication
Impact
Information Disclosure, Data Tampering
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Published
20 October 2026
Updated
21 October 2026

Vendor fix

Update to the latest available version of Oracle Marketing in Oracle E-Business Suite.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

References

← All CVEs