Description
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Web Utilities). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Applications Framework accessible data. CVSS 3.1 Base Score 4.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-10-20
Score: 4.9 Medium
EPSS: n/a
KEV: No
Impact: Unauthorized data access via network
Action: Apply Patch
AI Analysis

Impact

The vulnerability is a remotely exploitable flaw in Oracle Applications Framework's Web Utilities that permits a high privileged attacker with network access via HTTP to read critical application data. The attacker gains unauthorized access to all data the framework exposes, compromising confidentiality. The weakness can be conceptualized as an exposure of sensitive information to an unauthorized actor (CWE‑200).

Affected Systems

Affected products are Oracle Applications Framework component of Oracle E‑Business Suite. Versions from 12.2.3 through 12.2.15 are impacted. Only those releases are listed as vulnerable; newer releases are not mentioned as affected.

Risk and Exploitability

The vulnerability is rated CVSS 3.1 base score 4.9, indicating moderate severity with a high confidentiality impact. The EPSS score is not available, and the issue is not listed in CISA KEV, suggesting limited current exploitation. Exploit requires network reachability over HTTP and a high‑privileged account, so the attack vector is AV:N with high privileges required.

Generated by OpenCVE AI on October 21, 2026 at 08:02 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest available patch or upgrade to a non‑vulnerable Oracle Applications Framework release following the advisory at oracle.com/security-alerts/cpuoct2026.html.
  • Restrict HTTP access to the Web Utilities endpoints to trusted network segments or implement firewall rules limiting exposure.
  • Disable or remove unused Web Utilities features and review access controls to minimize privileged accounts that can exploit the flaw.

Generated by OpenCVE AI on October 21, 2026 at 08:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 08:30:00 +0000

Type Values Removed Values Added
Title Oracle Applications Framework Web Utilities Vulnerability Enabling Unauthorized Data Access via HTTP
Weaknesses CWE-200

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Web Utilities). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Applications Framework accessible data. CVSS 3.1 Base Score 4.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle applications Framework
CPEs cpe:2.3:a:oracle:applications_framework:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle applications Framework
References
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Applications Framework
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:24:19.364Z

Reserved: 2026-09-08T21:49:12.414Z

Link: CVE-2026-87366

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:20:14.603

Modified: 2026-10-20T22:20:14.603

Link: CVE-2026-87366

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T08:15:09Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor