{"id":"CVE-2026-87366","kind":"vulnerability","aliases":["CVE-2026-87366"],"related":[],"title":"Oracle E-Business Suite: Web Utilities flaw exposes data to high-privileged users","description":"Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Web Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications Framework.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Applications Framework accessible data. CVSS 3.1 Base Score 4.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).","summary":"A flaw in the Web Utilities component of Oracle Applications Framework, part of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a highly privileged user reach data over HTTP that they should not see. Successful exploitation gives unauthorized read access to critical data accessible through the framework.","severity":"medium","cvss":4.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erp","oracle-ebs","package","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed E-Business Suite release level in Oracle Applications Manager or the `$APPL_TOP` patch information, and see whether it falls in `12.2.3` through `12.2.15`\n- Review the Oracle Critical Patch Update advisory for the patch that covers Web Utilities","fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Web Utilities, moving to a release outside `12.2.3` through `12.2.15` as Oracle directs\n- unknown for the exact patch number, as the sources do not give it","status":"open","published_at":"2026-10-20T22:20:14+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T04:31:13+00:00","updated_at":"2026-10-25T04:31:13+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:31:13Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Web Utilities, moving to a release outside `12.2.3` through `12.2.15` as Oracle directs\n- unknown for the exact patch number, as the sources do not give it","reach":"network","title":"Oracle E-Business Suite: Web Utilities flaw exposes data to high-privileged users","impact":"medium","summary":"A flaw in the Web Utilities component of Oracle Applications Framework, part of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a highly privileged user reach data over HTTP that they should not see. Successful exploitation gives unauthorized read access to critical data accessible through the framework.","category":"package","nicknames":[],"who_cares":["oracle-ebs","self-hosted","erp"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads critical data across Oracle Applications Framework accessible records","analyst_note":"Confirm the exact Oracle CPU patch number and whether a fix is available for the affected 12.2.x range; the NVD entry lacks it.","how_to_check":"- Check the installed E-Business Suite release level in Oracle Applications Manager or the `$APPL_TOP` patch information, and see whether it falls in `12.2.3` through `12.2.15`\n- Review the Oracle Critical Patch Update advisory for the patch that covers Web Utilities","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Web Utilities component reachable over HTTP. Exploitation needs a high-privileged account, so exposure depends on how many such accounts exist and who holds them. Teams on unaffected releases or on fully patched 12.2.x builds can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000691,"input_tokens":3463,"output_tokens":689,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-87366':18A,21A '/av':153C '12.2.15':50B,101C '12.2.3':48B,100C '3.1':143C,152C '4.9':146C 'access':70B,74B,111C,128C,134C,140C 'affect':98C 'allow':105C 'applic':39B,82C,117C,138C 'attack':108C,120C 'base':144C 'busi':4A,46B,89C 'complet':133C 'compon':36B,91C 'compromis':115C 'confidenti':147C 'critic':72B,130C 'cve':16A,19A 'cvss':142C,149C,151C 'data':10A,57B,73B,131C,141C 'e':3A,45B,88C 'e-busi':2A,44B,87C 'easili':102C 'eb':25B 'erp':22B 'exploit':66B,103C 'expos':9A 'flaw':8A,31B 'framework':40B,77B,83C,118C,139C 'give':67B 'h/i':159C 'h/ui':156C 'high':13A,53B,106C 'high-privileg':12A 'host':29B 'http':59B,113C 'impact':148C 'l/pr':155C 'let':51B 'n':161C 'n/a':160C 'n/ac':154C 'n/s':157C 'network':110C 'oracl':1A,24B,38B,43B,81C,86C,116C,137C 'oracle-eb':23B 'packag':26B 'part':41B 'privileg':14A,54B,107C 'product':84C 'reach':56B 'read':69B 'result':125C 'score':145C 'see':64B 'self':28B 'self-host':27B 'success':65B,119C 'suit':5A,47B,90C 'support':94C 'u/c':158C 'unauthor':68B,127C 'user':15A,55B 'util':7A,35B,93C 'vector':150C 'version':95C 'via':112C 'vulner':78C,104C,123C 'web':6A,34B,92C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Web Utilities component reachable over HTTP. Exploitation needs a high-privileged account, so exposure depends on how many such accounts exist and who holds them. Teams on unaffected releases or on fully patched 12.2.x builds can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87366","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87366","severity":null,"published_at":"2026-10-20T22:20:14+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}