{"id":"CVE-2026-87402","kind":"vulnerability","aliases":["CVE-2026-87402"],"related":[],"title":"Oracle E-Business Suite: AD Utilities flaw lets local users take over Applications DBA","description":"Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).","summary":"Oracle E-Business Suite's Applications DBA component, in the AD Utilities area, has a flaw that lets a low-privileged user who can log on to the host take over the product. The sources say a person other than the attacker must interact for the attack to succeed, and the CVSS vector rates confidentiality, integrity and availability impact as high.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["applications-dba","on-prem-erp","oracle-ebs","vendor"],"not_affected_if":["unknown"],"how_to_check":"- Confirm the Oracle E-Business Suite release in use: unknown, the sources list affected versions as 12.2.3-12.2.15 only\n- Check whether the Applications DBA / AD Utilities patch level is current against Oracle's Critical Patch Update advisory: unknown","fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Applications DBA (AD Utilities): unknown version, sources do not say","status":"open","published_at":"2026-10-20T22:20:18+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T03:27:25+00:00","updated_at":"2026-10-25T03:27:25+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:27:25Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Applications DBA (AD Utilities): unknown version, sources do not say","reach":"local","title":"Oracle E-Business Suite: AD Utilities flaw lets local users take over Applications DBA","impact":"high","summary":"Oracle E-Business Suite's Applications DBA component, in the AD Utilities area, has a flaw that lets a low-privileged user who can log on to the host take over the product. The sources say a person other than the attacker must interact for the attack to succeed, and the CVSS vector rates confidentiality, integrity and availability impact as high.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","applications-dba","on-prem-erp"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over Applications DBA, with full confidentiality, integrity and availability impact","analyst_note":"Find Oracle's CPU advisory or patch note for CVE-2026-87402 to get fixed patch levels and checks; the NVD entry lacks them.","how_to_check":"- Confirm the Oracle E-Business Suite release in use: unknown, the sources list affected versions as 12.2.3-12.2.15 only\n- Check whether the Applications DBA / AD Utilities patch level is current against Oracle's Critical Patch Update advisory: unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Sites running Oracle E-Business Suite release 12.2.3 through 12.2.15 where Applications DBA is executed, since the attacker needs logon to the infrastructure where it runs. Sites on other releases or without shell access for untrusted users are less exposed; the sources do not say more.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000674,"input_tokens":3470,"output_tokens":653,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-87402':18A,21A '/av':177C '12.2.15':118C '12.2.3':117C '3.1':164C,176C '7.3':167C 'ad':6A,44B,109C 'affect':115C 'allow':122C 'applic':14A,23B,39B,99C,132C,137C,161C 'applications-dba':22B 'area':46B 'attack':76B,81B,125C,140C,150C,152C 'avail':92B,171C 'base':165C 'busi':4A,36B,106C 'compon':41B,108C 'compromis':136C 'confidenti':89B,168C 'cve':16A,19A 'cvss':86B,163C,173C,175C 'dba':15A,24B,40B,100C,133C,138C,162C 'e':3A,35B,105C 'e-busi':2A,34B,104C 'easili':119C 'eb':31B 'erp':28B 'execut':134C 'exploit':120C 'flaw':8A,49B 'h':185C 'h/a':184C 'h/i':183C 'high':95B 'host':63B 'human':142C 'impact':93B,172C 'infrastructur':130C 'integr':90B,169C 'interact':78B,143C 'l/ac':178C 'l/pr':179C 'l/ui':180C 'let':9A,51B 'local':10A 'log':59B 'logon':127C 'low':54B,123C 'low-privileg':53B 'must':77B 'on-prem-erp':25B 'oracl':1A,30B,33B,103C 'oracle-eb':29B 'person':72B,146C 'prem':27B 'privileg':55B,124C 'product':67B,101C 'r/s':181C 'rate':88B 'requir':141C 'result':157C 'say':70B 'score':166C 'sourc':69B 'succeed':83B 'success':139C,151C 'suit':5A,37B,107C 'support':111C 'take':12A,64B 'takeov':159C 'u/c':182C 'user':11A,56B 'util':7A,45B,110C 'vector':87B,174C 'vendor':32B 'version':112C 'vulner':96C,121C,155C","nicknames":[],"mitigations":[],"who_affected":"Sites running Oracle E-Business Suite release 12.2.3 through 12.2.15 where Applications DBA is executed, since the attacker needs logon to the infrastructure where it runs. Sites on other releases or without shell access for untrusted users are less exposed; the sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87402","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87402","severity":null,"published_at":"2026-10-20T22:20:18+00:00","modified_at":"2026-10-21T18:45:11+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}