{"id":"CVE-2026-87358","kind":"vulnerability","aliases":["CVE-2026-87358"],"related":[],"title":"Oracle E-Business Suite General Ledger: low-privilege users can alter or crash data","description":"Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle General Ledger.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle General Ledger accessible data as well as  unauthorized read access to a subset of Oracle General Ledger accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle General Ledger. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H).","summary":"Oracle E-Business Suite's General Ledger module, in versions 12.2.3 through 12.2.15, has a flaw in its Internal Operations component. A logged-in user with low privileges over HTTP can modify or delete critical ledger data, read a subset of it, or crash the module repeatedly.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["finance-systems","general-ledger","oracle-ebs","vendor"],"not_affected_if":["unaffected-release"],"how_to_check":"- Confirm the installed E-Business Suite release and whether General Ledger is in use, since the sources only name versions `12.2.3` through `12.2.15` as affected.\n- unknown for further checks; the sources do not give a file, setting or command to verify the patch level.","fix":"- Apply the Oracle Critical Patch Update that covers this CVE for E-Business Suite 12.2.x; the sources do not name the patch number or fixed version.\n- unknown for the exact target version.","status":"open","published_at":"2026-10-20T22:20:13+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T03:34:18+00:00","updated_at":"2026-10-25T03:34:18+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:34:18Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update that covers this CVE for E-Business Suite 12.2.x; the sources do not name the patch number or fixed version.\n- unknown for the exact target version.","reach":"network","title":"Oracle E-Business Suite General Ledger: low-privilege users can alter or crash data","impact":"high","summary":"Oracle E-Business Suite's General Ledger module, in versions 12.2.3 through 12.2.15, has a flaw in its Internal Operations component. A logged-in user with low privileges over HTTP can modify or delete critical ledger data, read a subset of it, or crash the module repeatedly.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","general-ledger","finance-systems"],"confidence":0.6,"needs_auth":"yes","worst_case":"Ledger data modified or deleted, some data read, and the module crashed repeatedly.","analyst_note":"Find Oracle's Critical Patch Update advisory for this CVE to get the patch name and fixed version, since the NVD entry gives neither.","how_to_check":"- Confirm the installed E-Business Suite release and whether General Ledger is in use, since the sources only name versions `12.2.3` through `12.2.15` as affected.\n- unknown for further checks; the sources do not give a file, setting or command to verify the patch level.","needs_analyst":true,"not_affected_if":["unaffected-release"],"who_is_affected":"Organisations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the General Ledger module exposed over HTTP. Sites on other releases or without General Ledger are not named as affected in the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000663,"input_tokens":3543,"output_tokens":617,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':18A,21A '-87358':19A,22A '/av':194C '12.2.15':46B,105C '12.2.3':44B,104C '3.1':181C,193C '7.1':184C 'abil':165C 'access':116C,137C,146C,153C,161C 'affect':102C 'allow':110C 'alter':13A 'attack':113C,125C 'avail':188C 'base':182C 'busi':4A,36B,93C 'caus':167C 'complet':174C 'compon':54B,95C 'compromis':120C 'confidenti':185C 'crash':15A,78B,173C 'creation':133C 'critic':69B,139C 'cve':17A,20A 'cvss':180C,190C,192C 'data':16A,71B,140C,147C,162C 'delet':68B,134C 'difficult':106C 'dos':175C 'e':3A,35B,92C 'e-busi':2A,34B,91C 'eb':31B 'exploit':108C 'financ':24B 'finance-system':23B 'flaw':49B 'frequent':171C 'general':6A,27B,39B,86C,122C,144C,159C,178C 'general-ledg':26B 'h':202C 'h/a':201C 'h/pr':196C 'hang':169C 'http':64B,118C 'impact':189C 'integr':186C 'intern':52B,96C 'l/i':200C 'l/ui':197C 'ledger':7A,28B,40B,70B,87C,123C,145C,160C,179C 'log':57B 'logged-in':56B 'low':9A,61B,111C 'low-privileg':8A 'modif':136C 'modifi':66B 'modul':41B,80B 'n/ac':195C 'n/s':198C 'network':115C 'oper':53B,97C 'oracl':1A,30B,33B,85C,90C,121C,143C,158C,177C 'oracle-eb':29B 'privileg':10A,62B,112C 'product':88C 'read':72B,152C 'repeat':81B,172C 'result':130C 'score':183C 'subset':74B,156C 'success':124C 'suit':5A,37B,94C 'support':98C 'system':25B 'u/c':199C 'unauthor':132C,151C,164C 'user':11A,59B 'vector':191C 'vendor':32B 'version':43B,99C 'via':117C 'vulner':82C,109C,128C 'well':149C","nicknames":[],"mitigations":[],"who_affected":"Organisations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the General Ledger module exposed over HTTP. Sites on other releases or without General Ledger are not named as affected in the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87358","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87358","severity":null,"published_at":"2026-10-20T22:20:13+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}