{"id":"CVE-2026-87357","kind":"vulnerability","aliases":["CVE-2026-87357"],"related":[],"title":"Oracle E-Business Suite: Order Capture flaw lets privileged users take over the product","description":"Vulnerability in the Order Capture product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Order Capture.  Successful attacks of this vulnerability can result in takeover of Order Capture. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle E-Business Suite's Order Capture module, under the Internal Operations component, has a flaw that lets a high-privileged user reach it over HTTP and fully take it over. Affected supported versions are listed as 12.2.3 through 12.2.15, with a CVSS 3.1 score of 7.2.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erp","oracle-ebs","order-capture","other"],"not_affected_if":["order-capture-unused","other-release"],"how_to_check":"- Check the installed E-Business Suite release against `12.2.3` through `12.2.15`\n- unknown for other checks, the sources do not say","fix":"- unknown, the sources do not name a patch or fixed release","status":"open","published_at":"2026-10-20T22:20:13+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T03:29:08+00:00","updated_at":"2026-10-25T03:29:08+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:29:08Z","model":"claude-haiku-5-5","output":{"fix":"- unknown, the sources do not name a patch or fixed release","reach":"network","title":"Oracle E-Business Suite: Order Capture flaw lets privileged users take over the product","impact":"high","summary":"Oracle E-Business Suite's Order Capture module, under the Internal Operations component, has a flaw that lets a high-privileged user reach it over HTTP and fully take it over. Affected supported versions are listed as 12.2.3 through 12.2.15, with a CVSS 3.1 score of 7.2.","category":"other","nicknames":[],"who_cares":["oracle-ebs","order-capture","erp"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker with high privileges takes over Order Capture, affecting confidentiality, integrity and availability","analyst_note":"Find Oracle's Critical Patch Update advisory and patch number for E-Business Suite 12.2.3-12.2.15 at https://nvd.nist.gov/vuln/detail/CVE-2026-87357 and confirm the fixed release.","how_to_check":"- Check the installed E-Business Suite release against `12.2.3` through `12.2.15`\n- unknown for other checks, the sources do not say","needs_analyst":true,"not_affected_if":["other-release","order-capture-unused"],"who_is_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Order Capture module in use. The attacker needs high privileges, so exposure is mostly a concern for internal users and admins with network access to the application. Teams on other releases, or without Order Capture, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000642,"input_tokens":3434,"output_tokens":598,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-87357':18A,21A '/av':143C '12.2.15':70B,100C '12.2.3':68B,99C '3.1':74B,130C,142C '7.2':77B,133C 'access':110C 'affect':62B,97C 'allow':104C 'attack':107C,118C 'avail':137C 'base':131C 'busi':4A,32B,88C 'captur':7A,28B,36B,82C,116C,128C 'compon':42B,90C 'compromis':114C 'confidenti':134C 'cve':16A,19A 'cvss':73B,129C,139C,141C 'e':3A,31B,87C 'e-busi':2A,30B,86C 'easili':101C 'eb':25B 'erp':22B 'exploit':102C 'flaw':8A,45B 'fulli':58B 'h':151C 'h/a':150C 'h/i':149C 'h/ui':146C 'high':50B,105C 'high-privileg':49B 'http':56B,112C 'impact':138C 'integr':135C 'intern':40B,91C 'l/pr':145C 'let':9A,47B 'list':66B 'modul':37B 'n/ac':144C 'n/s':147C 'network':109C 'oper':41B,92C 'oracl':1A,24B,29B,85C 'oracle-eb':23B 'order':6A,27B,35B,81C,115C,127C 'order-captur':26B 'privileg':10A,51B,106C 'product':15A,83C 'reach':53B 'result':123C 'score':75B,132C 'success':117C 'suit':5A,33B,89C 'support':63B,93C 'take':12A,59B 'takeov':125C 'u/c':148C 'user':11A,52B 'vector':140C 'version':64B,94C 'via':111C 'vulner':78C,103C,121C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Order Capture module in use. The attacker needs high privileges, so exposure is mostly a concern for internal users and admins with network access to the application. Teams on other releases, or without Order Capture, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87357","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87357","severity":null,"published_at":"2026-10-20T22:20:13+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}