Live › vulnerability › CVE-2026-87366
Go to dashboardA flaw in the Web Utilities component of Oracle Applications Framework, part of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a highly privileged user reach data over HTTP that they should not see. Successful exploitation gives unauthorized read access to critical data accessible through the framework.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Web Utilities component reachable over HTTP. Exploitation needs a high-privileged account, so exposure depends on how many such accounts exist and who holds them. Teams on unaffected releases or on fully patched 12.2.x builds can skip it.
No product ranges from the sources yet.
$APPL_TOP patch information, and see whether it falls in 12.2.3 through 12.2.1512.2.3 through 12.2.15 as Oracle directsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Web Utilities). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Applications Framework accessible data. CVSS 3.1 Base Score 4.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-87366")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.