Description
Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Applications DBA accessible data as well as unauthorized access to critical data or complete access to all Applications DBA accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-10-20
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized modification and access to application data
Action: Immediate Patch
AI Analysis

Impact

The vulnerability in the Applications DBA product of Oracle E‑Business Suite allows a low‑privileged attacker who has logged on to the infrastructure where Applications DBA runs to compromise the application. By exploiting the flaw, an attacker can create, delete, or modify critical data or gain complete access to all data accessible through Applications DBA, thereby compromising data confidentiality and integrity. The weakness is reflected in the CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, indicating a local attack with low technical effort and no user interaction.

Affected Systems

Oracle Corporation’s Applications DBA component within Oracle E‑Business Suite, specifically the AD Utilities module. Versions affected are 12.2.3 through 12.2‑15. Users of these releases should verify their installation against the listed range.

Risk and Exploitability

The CVSS 3.1 base score of 7.1 denotes a high Impact to confidentiality and integrity with no impact on availability. EPSS is not available, but the vulnerability is listed as not in KEV, suggesting no current exploitation in the wild. Because the attack vector is local and requires only a low‑privileged login, the risk is significant for environments where such logins are common. Mitigation is crucial to prevent potential data loss or tampering.

Generated by OpenCVE AI on October 21, 2026 at 14:53 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle patch for Oracle E‑Business Suite 12.2.16 or later if available.
  • Upgrade the Applications DBA installation to a supported release that includes the fix, or replace it with a more recent version of Oracle E‑Business Suite.
  • Limit local logon rights for infrastructure accounts, ensuring only trusted, privileged users can access the Applications DBA server.
  • Implement least‑privilege permissions on the Applications DBA components and validate access controls to prevent unauthorized data modifications.

Generated by OpenCVE AI on October 21, 2026 at 14:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title Oracle Applications DBA Local Exploit Enables Unauthorized Data Modification
Weaknesses CWE-284
CWE-285

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Applications DBA accessible data as well as unauthorized access to critical data or complete access to all Applications DBA accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle applications Dba
CPEs cpe:2.3:a:oracle:applications_dba:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle applications Dba
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Applications Dba
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-21T14:00:57.159Z

Reserved: 2026-09-08T21:49:12.416Z

Link: CVE-2026-87403

cve-icon Vulnrichment

Updated: 2026-10-21T14:00:49.717Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:18.803

Modified: 2026-10-21T18:45:11.277

Link: CVE-2026-87403

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T21:30:14Z

Weaknesses