---
id: "CVE-2026-87357"
kind: "vulnerability"
aliases: ["CVE-2026-87357"]
title: "Oracle E-Business Suite: Order Capture flaw lets privileged users take over the product"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["erp", "oracle-ebs", "order-capture", "other"]
not_affected_if: ["order-capture-unused", "other-release"]
published_at: "2026-10-20T22:20:13+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-25T03:29:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87357", "first_seen_at": "2026-10-23T21:57:25+00:00"}]
---

# Oracle E-Business Suite: Order Capture flaw lets privileged users take over the product

Oracle E-Business Suite's Order Capture module, under the Internal Operations component, has a flaw that lets a high-privileged user reach it over HTTP and fully take it over. Affected supported versions are listed as 12.2.3 through 12.2.15, with a CVSS 3.1 score of 7.2.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed E-Business Suite release against `12.2.3` through `12.2.15`
- unknown for other checks, the sources do not say

## Fix

- unknown, the sources do not name a patch or fixed release

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87357

## From the sources

Vulnerability in the Order Capture product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Order Capture.  Successful attacks of this vulnerability can result in takeover of Order Capture. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_