Description
Vulnerability in the Pasta product of Oracle E-Business Suite (component: Printing Engine). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Pasta. Successful attacks of this vulnerability can result in takeover of Pasta. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A vulnerability exists in Oracle Pasta’s Printing Engine that allows an attacker with low privileges and only network access via HTTP to compromise the Pasta service. Successful exploitation can lead to a full takeover of the service, thereby impacting confidentiality, integrity, and availability. The weakness is identified as CWE‑306, indicating missing authentication for a critical function, which permits the attacker to execute privileged operations without proper authorization.

Affected Systems

Oracle Pasta, part of Oracle E‑Business Suite, is affected for versions 12.2.3 through 12.2.15. Only these releases are susceptible to the described remote code execution flaw.

Risk and Exploitability

The CVSS 3.1 score of 7.5 indicates a high severity vulnerability. EPSS information is less than 1%, suggesting a very low probability of exploitation in the wild, but the issue is not listed in the CISA KEV catalog. The attack vector is network‑based (HTTP), and a low‑privileged attacker can exploit it, making the risk significant for exposed systems.

Generated by OpenCVE AI on October 22, 2026 at 08:12 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle security patch released in the October 2026 update to fix the Printing Engine flaw.
  • Restrict HTTP access to the Pasta service by implementing firewall or VPN rules so only trusted internal hosts can reach it.
  • Implement authentication controls for all critical functions in the Printing Engine to ensure that only authorized users can execute them.

Generated by OpenCVE AI on October 22, 2026 at 08:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 08:30:00 +0000

Type Values Removed Values Added
Title Missing Authentication Enables Full Takeover of Oracle Pasta Printing Engine

Thu, 22 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 03:00:00 +0000

Type Values Removed Values Added
Title Low-Privilege Remote Code Execution via Printing Engine in Oracle Pasta
Weaknesses CWE-862

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306

Wed, 21 Oct 2026 08:00:00 +0000

Type Values Removed Values Added
Title Low-Privilege Remote Code Execution via Printing Engine in Oracle Pasta
Weaknesses CWE-862

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Pasta product of Oracle E-Business Suite (component: Printing Engine). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Pasta. Successful attacks of this vulnerability can result in takeover of Pasta. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle pasta
CPEs cpe:2.3:a:oracle:pasta:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle pasta
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Pasta
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-21T14:01:34.046Z

Reserved: 2026-09-08T21:49:12.416Z

Link: CVE-2026-87404

cve-icon Vulnrichment

Updated: 2026-10-21T14:01:29.119Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:18.920

Modified: 2026-10-21T18:45:11.277

Link: CVE-2026-87404

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T20:00:12Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function