Live › vulnerability › CVE-2026-87356
Go to dashboardOracle E-Business Suite's Applications Platform Engineering component, versions 12.2.3 through 12.2.15, has a flaw in its Valid Session handling. An attacker with a low-privileged logon to the host where it runs can take over the component, with full confidentiality, integrity and availability impact.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Oracle E-Business Suite 12.2.3 through 12.2.15 where users hold a low-privileged logon to the infrastructure hosting Applications Platform Engineering. The sources do not say which deployment setups are most exposed, so unknown for narrower scoping. Teams on releases outside 12.2.3 to 12.2.15 are not listed as affected.
No product ranges from the sources yet.
12.2.3 through 12.2.15 in the Oracle E-Business Suite environment12.2.15 (exact patch unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Applications Platform Engineering product of Oracle E-Business Suite (component: Valid Session). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications Platform Engineering executes to compromise Applications Platform Engineering. Successful attacks of this vulnerability can result in takeover of Applications Platform Engineering. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
This page as .md · .json · in your agent: get_signal("CVE-2026-87356")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.