# CVE-2026-101857: Oracle Order Management data exposure in Product Diagnostic Tools

Source: https://junglewise.ai/threats/cve-2026-101857-vulnerability-in-the-oracle-order-management-product-of-oracle-e  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-101857 · Severity: medium · CVSS 6.5 · Published 2026-10-20

Oracle Order Management is a business application used to manage sales orders within Oracle E-Business Suite. A flaw in its diagnostic tools allows low-privileged users to access sensitive order data over the network without proper authorization. Attackers could read critical business information or customer data stored in the system.

Technologies: [Oracle Order Management](https://junglewise.ai/threats/technologies/order-management). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2026-101857 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-101857 being exploited in the wild.

**How severe is CVE-2026-101857?** Medium severity, with a CVSS score of 6.5, published 20 October 2026.

**Which products and versions are affected?** Oracle Order Management 12.2.3 to 12.2.15.

**Is there a fix for CVE-2026-101857?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-101857 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-101857?** Check whether you run Oracle Order Management at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A network-accessible vulnerability in Oracle Order Management's Product Diagnostic Tools component allows low-privileged, authenticated attackers to read unauthorized data via HTTP. No code execution or integrity impact; confidentiality compromise only. The vulnerability affects versions 12.2.3 through 12.2.15.

## Affected products

- Oracle Order Management 12.2.3 to 12.2.15

## Timeline

- 2026-10-20: disclosed

## References

- [https://www.oracle.com/security-alerts/cpuoct2026.html](https://www.oracle.com/security-alerts/cpuoct2026.html)

## Related threats

- [Oracle Order Management information disclosure in Product Diagnostic Tools](https://junglewise.ai/threats/cve-2026-101832-vulnerability-in-the-oracle-order-management-product-of-oracle-e)
- [Oracle Order Management unauthorized data access in Product Diagnostic Tools](https://junglewise.ai/threats/cve-2026-101538-vulnerability-in-the-oracle-order-management-product-of-oracle-e)
- [Oracle Order Management data access vulnerability in Enterprise Command Center](https://junglewise.ai/threats/cve-2026-87158-oracle-order-management-data-access-vulnerability-in-enterprise)
- [Oracle Order Management privilege escalation in Product Diagnostic Tools](https://junglewise.ai/threats/cve-2026-70932-oracle-order-management-privilege-escalation-in-product)
- [Oracle Order Management authentication bypass in Product Diagnostic Tools](https://junglewise.ai/threats/cve-2026-70930-oracle-order-management-authentication-bypass-in-product)