Is CVE-2026-101711 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-101711 being exploited in the wild.

How severe is CVE-2026-101711?

Medium severity, with a CVSS score of 6.6, published 20 October 2026.

Which products and versions are affected?

Oracle E-Business Suite 12.2.3-12.2.15.

Is there a fix for CVE-2026-101711?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-101711 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-101711?

Check whether you run Oracle E-Business Suite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101711: Oracle E-Business Suite Payroll privilege escalation

CVE-2026-101711 · Severity: medium · CVSS 6.6 · Published 2026-10-20

Oracle E-Business Suite is a widely-used enterprise resource planning system that manages critical business functions including payroll. This vulnerability allows a high-privileged attacker with network access to take over the payroll module, risking unauthorized access to sensitive payroll data and potential system compromise. The attack is difficult to execute and requires existing high-level privileges, reducing but not eliminating the overall risk.

Technologies: Oracle E-Business Suite. Vendors: Oracle.

Quick answers

Is CVE-2026-101711 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-101711 being exploited in the wild.
How severe is CVE-2026-101711?: Medium severity, with a CVSS score of 6.6, published 20 October 2026.
Which products and versions are affected?: Oracle E-Business Suite 12.2.3-12.2.15.
Is there a fix for CVE-2026-101711?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-101711 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-101711?: Check whether you run Oracle E-Business Suite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A privilege escalation vulnerability exists in the Payroll component of Oracle E-Business Suite, accessible over HTTP to high-privileged users. The difficult exploitation barrier (high complexity, high privilege requirement, no user interaction) limits attack surface but successful exploitation results in complete takeover of the payroll system. The vulnerability affects versions 12.2.3 through 12.2.15; a fix status is not indicated in the advisory.

Affected products

Oracle E-Business Suite 12.2.3-12.2.15

Timeline

2026-10-20: disclosed

References

https://www.oracle.com/security-alerts/cpuoct2026.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.