---
id: "CVE-2026-87358"
kind: "vulnerability"
aliases: ["CVE-2026-87358"]
title: "Oracle E-Business Suite General Ledger: low-privilege users can alter or crash data"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["finance-systems", "general-ledger", "oracle-ebs", "vendor"]
not_affected_if: ["unaffected-release"]
published_at: "2026-10-20T22:20:13+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-25T03:34:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87358", "first_seen_at": "2026-10-23T21:57:25+00:00"}]
---

# Oracle E-Business Suite General Ledger: low-privilege users can alter or crash data

Oracle E-Business Suite's General Ledger module, in versions 12.2.3 through 12.2.15, has a flaw in its Internal Operations component. A logged-in user with low privileges over HTTP can modify or delete critical ledger data, read a subset of it, or crash the module repeatedly.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the installed E-Business Suite release and whether General Ledger is in use, since the sources only name versions `12.2.3` through `12.2.15` as affected.
- unknown for further checks; the sources do not give a file, setting or command to verify the patch level.

## Fix

- Apply the Oracle Critical Patch Update that covers this CVE for E-Business Suite 12.2.x; the sources do not name the patch number or fixed version.
- unknown for the exact target version.

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87358

## From the sources

Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle General Ledger.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle General Ledger accessible data as well as  unauthorized read access to a subset of Oracle General Ledger accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle General Ledger. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_