Description
Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Applications DBA. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Applications DBA accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data access by a low‑privileged attacker via HTTP
Action: Apply Patch
AI Analysis

Impact

The vulnerability resides in the Applications DBA component of Oracle E‑Business Suite. It permits an attacker who has only low privileges on the network to exfiltrate or view all data that the application can access. The flaw is easily exploitable without user interaction, and the impact is a breach of confidentiality.

Affected Systems

Oracle Corporation’s Applications DBA product of the Oracle E‑Business Suite, versions 12.2.3 through 12.2.15, is affected. Only this product family and the specified version range are listed.

Risk and Exploitability

The CVSS 3.1 score of 6.5 indicates a medium severity, with the attack vector being network (HTTP) and low attack complexity. The EPSS score of <1% suggests a very low but non‑zero probability of exploitation, and the vulnerability is not listed in CISA KEV. The description states the flaw is easily exploitable by a low‑privileged attacker, underscoring that the risk is realistic if the affected version is still in use.

Generated by OpenCVE AI on October 28, 2026 at 18:08 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle CPU patch that addresses this vulnerability.
  • Restrict HTTP access to the Applications DBA service to trusted IP addresses or networks.
  • Enable logging and monitor for unusual authentication activity to detect potential exploitation attempts.

Generated by OpenCVE AI on October 28, 2026 at 18:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Title Network Access Exploit Allows Full Data Disclosure in Oracle Applications DBA

Wed, 28 Oct 2026 16:15:00 +0000

Type Values Removed Values Added
Title Low‑Privileged HTTP Attack Enables Unauthorized Data Access in Oracle Applications DBA
Weaknesses CWE-284

Wed, 28 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 18:00:00 +0000

Type Values Removed Values Added
Title Low‑Privileged HTTP Attack Enables Unauthorized Data Access in Oracle Applications DBA
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Applications DBA. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Applications DBA accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle applications Dba
CPEs cpe:2.3:a:oracle:applications_dba:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle applications Dba
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Applications Dba
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T12:44:57.497Z

Reserved: 2026-09-08T21:49:12.412Z

Link: CVE-2026-87335

cve-icon Vulnrichment

Updated: 2026-10-28T12:44:52.867Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:11.127

Modified: 2026-10-28T13:17:21.917

Link: CVE-2026-87335

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T18:15:14Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor