---
id: "CVE-2026-87366"
kind: "vulnerability"
aliases: ["CVE-2026-87366"]
title: "Oracle E-Business Suite: Web Utilities flaw exposes data to high-privileged users"
severity: "medium"
cvss: 4.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["erp", "oracle-ebs", "package", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-20T22:20:14+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-25T04:31:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87366", "first_seen_at": "2026-10-23T21:57:25+00:00"}]
---

# Oracle E-Business Suite: Web Utilities flaw exposes data to high-privileged users

A flaw in the Web Utilities component of Oracle Applications Framework, part of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a highly privileged user reach data over HTTP that they should not see. Successful exploitation gives unauthorized read access to critical data accessible through the framework.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed E-Business Suite release level in Oracle Applications Manager or the `$APPL_TOP` patch information, and see whether it falls in `12.2.3` through `12.2.15`
- Review the Oracle Critical Patch Update advisory for the patch that covers Web Utilities

## Fix

- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Web Utilities, moving to a release outside `12.2.3` through `12.2.15` as Oracle directs
- unknown for the exact patch number, as the sources do not give it

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87366

## From the sources

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Web Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications Framework.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Applications Framework accessible data. CVSS 3.1 Base Score 4.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_