Description
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Applications Framework accessible data as well as unauthorized access to critical data or complete access to all Oracle Applications Framework accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
Published: 2026-10-20
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Data Modification and Unauthorized Access
Action: Apply Patch
AI Analysis

Impact

The vulnerability resides in the Personalization component of Oracle Applications Framework. Remote attackers with low privileges can exploit it over HTTP, but the attack requires user interaction from a person other than the attacker. Successful exploitation allows the attacker to create, delete, or modify critical data, which results in significant confidentiality and integrity breaches.

Affected Systems

Oracle Applications Framework, part of Oracle E‑Business Suite, ranging from version 12.2.3 up to 12.2.15, contain the Personalization component that is vulnerable.

Risk and Exploitability

The CVSS 3.1 Base Score of 8.7 indicates high severity. The attack vector is network‑based, with low complexity and low privilege requirements, making it accessible to a wide range of adversaries. However, the need for user interaction and the scope‑change modifier mean that a successful attack can affect additional products within the application ecosystem. The EPSS score of < 1% indicates a very low but non‑zero probability of exploitation, and the vulnerability is not listed in CISA KEV.

Generated by OpenCVE AI on October 22, 2026 at 09:49 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor patch or update to the latest supported release of Oracle Applications Framework
  • Restrict HTTP access to the Personalization component by limiting exposure to trusted internal networks or requiring VPN usage
  • Enforce least‑privilege access controls and disable the Personalization feature for low‑privileged accounts
  • Implement CSRF protection for personalization requests, such as anti‑CSRF tokens or same‑origin checks

Generated by OpenCVE AI on October 22, 2026 at 09:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 10:15:00 +0000

Type Values Removed Values Added
Title Cross‑Site Request Forgery Allows Unauthorized Data Modification in Oracle Applications Framework

Thu, 22 Oct 2026 01:45:00 +0000

Type Values Removed Values Added
Title Oracle Applications Framework Personalization Data Modification Vulnerability via HTTP
Weaknesses CWE-284

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title Oracle Applications Framework Personalization Data Modification Vulnerability via HTTP
Weaknesses CWE-284
CWE-352

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Applications Framework accessible data as well as unauthorized access to critical data or complete access to all Oracle Applications Framework accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
First Time appeared Oracle
Oracle applications Framework
CPEs cpe:2.3:a:oracle:applications_framework:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle applications Framework
References
Metrics cvssV3_1

{'score': 8.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N'}

Subscriptions

Oracle Applications Framework
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T03:55:35.078Z

Reserved: 2026-09-08T21:49:12.417Z

Link: CVE-2026-87408

cve-icon Vulnrichment

Updated: 2026-10-21T13:45:30.366Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:19.137

Modified: 2026-10-27T04:18:00.813

Link: CVE-2026-87408

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T10:00:05Z

Weaknesses
  • CWE-352

    Cross-Site Request Forgery (CSRF)