Description
Vulnerability in the Order Capture product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Order Capture. Successful attacks of this vulnerability can result in takeover of Order Capture. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A vulnerability in Oracle Order Capture (E-Business Suite, Internal Operations) allows an attacker with high privileges and network access via HTTP to compromise the application. Successful exploitation can lead to takeover of Order Capture, compromising confidentiality, integrity, and availability. The CVSS 3.1 base score of 7.2 reflects these substantial impacts.

Affected Systems

The affected product is Oracle Order Capture. Versions between 12.2.3 and 12.2.15 inclusive are impacted. Vendors and products listed under the CNA are Oracle Corporation:Order Capture.

Risk and Exploitability

The CVSS vector indicates remote attack capability with low complexity and high privilege required. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is HTTP traffic from an attacker who already possesses high‑privilege credentials. Because the vulnerability permits full takeover, the risk is significant for systems exposed to the network, especially if physical or local protection is insufficient.

Generated by OpenCVE AI on October 21, 2026 at 17:13 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the available Oracle security patch for Order Capture versions 12.2.3 through 12.2.15 as per the Oracle CPU Oct 2026 advisory.
  • Restrict HTTP access to the Order Capture application to trusted IP ranges or internal networks; block public access if not required.
  • Ensure that only privileged users with verified identities can access critical Order Capture functions; review and tighten role‑based access controls.
  • Enable detailed logging for Order Capture transactions and monitor for anomalous activity such as repeated failed logins or unusual administrative actions.

Generated by OpenCVE AI on October 21, 2026 at 17:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title High Privileged Remote Code Execution in Oracle Order Capture via HTTP
Weaknesses CWE-264
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Order Capture product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Order Capture. Successful attacks of this vulnerability can result in takeover of Order Capture. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle order Capture
CPEs cpe:2.3:a:oracle:order_capture:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle order Capture
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Order Capture
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:24:16.201Z

Reserved: 2026-09-08T21:49:12.413Z

Link: CVE-2026-87357

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:13.553

Modified: 2026-10-21T18:44:19.627

Link: CVE-2026-87357

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T17:15:17Z

Weaknesses